Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS00cmdoLWp4NGYtcWZjcc4AAm_b
http before 0.13.3 vulnerable to header injection
An issue was discovered in the http package before 0.13.3 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request via HTTP header injection. This issue has been addressed in commit abb2bb182 by validating request methods.
Permalink: https://github.com/advisories/GHSA-4rgh-jx4f-qfcqJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00cmdoLWp4NGYtcWZjcc4AAm_b
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-4rgh-jx4f-qfcq, CVE-2020-35669
References:
- https://nvd.nist.gov/vuln/detail/CVE-2020-35669
- https://github.com/dart-lang/http/issues/511
- https://github.com/dart-lang/http/blob/master/CHANGELOG.md#0133
- https://github.com/dart-lang/http/pull/512
- https://github.com/dart-lang/http/commit/abb2bb182fbd7f03aafd1f889b902d7b3bdb8769
- https://pub.dev/packages/http/changelog#0133
- https://github.com/advisories/GHSA-4rgh-jx4f-qfcq
Blast Radius: 30.7
Affected Packages
pub:http
Dependent packages: 4,774Dependent repositories: 106,309
Downloads:
Affected Version Ranges: < 0.13.3
Fixed in: 0.13.3
All affected versions: 0.2.7, 0.2.8, 0.2.9, 0.2.10, 0.3.1, 0.3.2, 0.3.4, 0.3.5, 0.3.7, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.7, 0.5.0, 0.5.1, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.9, 0.5.11, 0.5.12, 0.5.13, 0.5.14, 0.5.14, 0.5.15, 0.5.16, 0.5.17, 0.5.20, 0.6.1, 0.6.2, 0.6.3, 0.6.5, 0.6.6, 0.6.8, 0.6.9, 0.6.9, 0.6.11, 0.6.12, 0.6.13, 0.6.14, 0.6.15, 0.6.15, 0.6.17, 0.6.17, 0.6.19, 0.6.20, 0.6.21, 0.7.0, 0.7.1, 0.7.2, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.6, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10, 0.8.10, 0.8.10, 0.9.0, 0.9.1, 0.9.2, 0.9.2, 0.9.2, 0.10.0, 0.11.0, 0.11.0, 0.11.1, 0.11.1, 0.11.1, 0.11.2, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.11.3, 0.12.0, 0.12.0, 0.12.0, 0.12.0, 0.12.0, 0.12.1, 0.12.2, 0.13.0, 0.13.1, 0.13.2
All unaffected versions: 0.13.3, 0.13.4, 0.13.5, 0.13.6, 1.0.0, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1