Vulnerability · Published Jan 4, 2023 · Assigned by GitHub_M
CVE-2023-22465Http4s has fatal error parsing User-Agent and Server headers
High 7.5
In plain English
A high-severity improper input validation in http4s from http4s. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.http4s:http4s-core | no fix listed | GHSA-54w6-vxfh-fw7f |
| Maven | org.http4s:http4s-core_2.10 | no fix listed | GHSA-54w6-vxfh-fw7f |
| Maven | org.http4s:http4s-core_2.11 | no fix listed | GHSA-54w6-vxfh-fw7f |
| Maven | org.http4s:http4s-core_2.12 | 0.21.34 | GHSA-54w6-vxfh-fw7f |
| Maven | org.http4s:http4s-core_2.12 | 0.22.15 | GHSA-54w6-vxfh-fw7f |
| Maven | org.http4s:http4s-core_2.12 | 0.23.17 | GHSA-54w6-vxfh-fw7f |
| Maven | org.http4s:http4s-core_2.13 | 1.0.0-M38 | GHSA-54w6-vxfh-fw7f |
| Maven | org.http4s:http4s-core_2.13 | 0.22.15 | GHSA-54w6-vxfh-fw7f |
| Maven | org.http4s:http4s-core_2.13 | 0.23.17 | GHSA-54w6-vxfh-fw7f |
| Maven | org.http4s:http4s-core_2.13 | 0.21.34 | GHSA-54w6-vxfh-fw7f |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f x_refsource_CONFIRM