Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThoeGgtcjZmNy1qZjQ1

Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact

A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by CVE-2020-11612.

Patches

Upgrade to http4s-async-http-client >= 0.21.8. All 1.0 milestones are also safe.

Workarounds

Add an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:

libraryDependencies ++= Seq(
  "io.netty" %  "netty-codec"         % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-codec-socks"   % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-handler-proxy" % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-common"        % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-transport"     % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-handler"       % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-resolver-dns"  % "4.1.53.Final" % Runtime
)

References

For more information

If you have any questions or comments about this advisory:

Open an issue in http4s
Contact a maintainer privately per http4s' security policy

Permalink: https://github.com/advisories/GHSA-8hxh-r6f7-jf45
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThoeGgtcjZmNy1qZjQ1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: about 4 years ago
Updated: almost 2 years ago

Identifiers: GHSA-8hxh-r6f7-jf45
References:

Repository: https://github.com/http4s/http4s
Blast Radius: 1.0

Affected Packages

maven:org.http4s:http4s-async-http-client_2.12

Dependent packages: 7
Dependent repositories: 0
Downloads:
Affected Version Ranges: <= 0.21.7
Fixed in: 0.21.8
All affected versions: 0.15.0, 0.15.1, 0.15.2, 0.15.3, 0.15.4, 0.15.5, 0.15.6, 0.15.7, 0.15.8, 0.15.9, 0.15.10, 0.15.11, 0.15.12, 0.15.13, 0.15.14, 0.15.15, 0.15.16, 0.16.0, 0.16.1, 0.16.2, 0.16.3, 0.16.4, 0.16.5, 0.16.6, 0.17.0, 0.17.1, 0.17.2, 0.17.3, 0.17.4, 0.17.5, 0.17.6, 0.18.0, 0.18.1, 0.18.2, 0.18.3, 0.18.4, 0.18.5, 0.18.6, 0.18.7, 0.18.8, 0.18.9, 0.18.10, 0.18.11, 0.18.12, 0.18.13, 0.18.14, 0.18.15, 0.18.16, 0.18.17, 0.18.18, 0.18.19, 0.18.20, 0.18.21, 0.18.22, 0.18.23, 0.18.24, 0.18.25, 0.18.26, 0.19.0, 0.20.0, 0.20.1, 0.20.2, 0.20.3, 0.20.4, 0.20.5, 0.20.6, 0.20.7, 0.20.8, 0.20.9, 0.20.10, 0.20.11, 0.20.12, 0.20.13, 0.20.14, 0.20.15, 0.20.16, 0.20.17, 0.20.18, 0.20.19, 0.20.20, 0.20.21, 0.20.22, 0.20.23, 0.21.0, 0.21.1, 0.21.2, 0.21.3, 0.21.4, 0.21.5, 0.21.6, 0.21.7
All unaffected versions: 0.21.8, 0.21.9, 0.21.11, 0.21.12, 0.21.13, 0.21.14, 0.21.15, 0.21.16, 0.21.17, 0.21.18, 0.21.19, 0.21.20, 0.21.21, 0.21.22, 0.21.23, 0.21.24, 0.21.25, 0.21.26, 0.21.27, 0.21.28, 0.21.29, 0.21.30, 0.21.31, 0.21.33, 0.21.34, 0.22.0, 0.22.1, 0.22.2, 0.22.3, 0.22.4, 0.22.5, 0.22.6, 0.22.7, 0.22.8, 0.22.9, 0.22.10, 0.22.11, 0.22.12, 0.22.13, 0.22.14, 0.22.15, 0.23.0, 0.23.1, 0.23.2, 0.23.3, 0.23.4, 0.23.5, 0.23.6, 0.23.7, 0.23.8, 0.23.9, 0.23.10, 0.23.11, 0.23.12

maven:org.http4s:http4s-async-http-client_2.13

Dependent packages: 7
Dependent repositories: 0
Downloads:
Affected Version Ranges: <= 0.21.7
Fixed in: 0.21.8
All affected versions: 0.21.0, 0.21.1, 0.21.2, 0.21.3, 0.21.4, 0.21.5, 0.21.6, 0.21.7
All unaffected versions: 0.21.8, 0.21.9, 0.21.11, 0.21.12, 0.21.13, 0.21.14, 0.21.15, 0.21.16, 0.21.17, 0.21.18, 0.21.19, 0.21.20, 0.21.21, 0.21.22, 0.21.23, 0.21.24, 0.21.25, 0.21.26, 0.21.27, 0.21.28, 0.21.29, 0.21.30, 0.21.31, 0.21.33, 0.21.34, 0.22.0, 0.22.1, 0.22.2, 0.22.3, 0.22.4, 0.22.5, 0.22.6, 0.22.7, 0.22.8, 0.22.9, 0.22.10, 0.22.11, 0.22.12, 0.22.13, 0.22.14, 0.22.15, 0.23.0, 0.23.1, 0.23.2, 0.23.3, 0.23.4, 0.23.5, 0.23.6, 0.23.7, 0.23.8, 0.23.9, 0.23.10, 0.23.11, 0.23.12