Lookup for vulnerable packages by Package URL.
| Purl | pkg:maven/org.http4s/http4s-core@0.23.0-M1 |
|---|
| Type | maven |
|---|
| Namespace | org.http4s |
|---|
| Name | http4s-core |
|---|
| Version | 0.23.0-M1 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 0.23.0-RC1 |
|---|
| Latest_non_vulnerable_version | 1.0.0-M23 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-zpsp-jh45-7ygv |
| vulnerability_id |
VCID-zpsp-jh45-7ygv |
| summary |
Path Traversal
Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority. The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the response. The contents and other metadata about the directory are not exposed. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2021-32643, GHSA-6h7w-fc84-x7p6
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zpsp-jh45-7ygv |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | 3.1 |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:maven/org.http4s/http4s-core@0.23.0-M1 |
|---|