Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXgzdjQtcHh2bS02M2o4

HTTP Request Smuggling in reel

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TECL smuggling attacks. Note, This project is deprecated, and is not maintained any more.

Permalink: https://github.com/advisories/GHSA-x3v4-pxvm-63j8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXgzdjQtcHh2bS02M2o4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 3 years ago
Updated: almost 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Percentage: 0.00091
EPSS Percentile: 0.39943

Identifiers: GHSA-x3v4-pxvm-63j8, CVE-2020-7659
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-7659
• https://snyk.io/vuln/SNYK-RUBY-REEL-569135
• https://github.com/advisories/GHSA-x3v4-pxvm-63j8

Blast Radius: 17.7

Affected Packages