Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2020-7622

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-gv3v-92v6-m48j

Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting) ### Impact - Cross Site Scripting - Cache Poisoning - Page Hijacking ### Patches This was fixed in version `2.2.1`. ### Workarounds If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters. ### References ##### CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') https://cwe.mitre.org/data/definitions/113.html I've been poking at libraries to see if they are vulnerable to HTTP Response Splitting and Jooby is my third case of finding this vulnerability. ### Root Cause This roots cause back to this line in the Jooby codebase: https://github.com/jooby-project/jooby/blob/93cfc80aa20c188f71a442ea7a1827da380e1c27/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java#L102 The `DefaultHttpHeaders` takes a parameter `validate` which, when `true` (as it is for the no-arg constructor) validates that the header isn't being abused to do HTTP Response Splitting. ### Reported By This vulnerability was reported by @JLLeitschuh (Twitter https://twitter.com/JLLeitschuh) ### For more information If you have any questions or comments about this advisory: * Open an issue in jooby-project/jooby https://github.com/jooby-project/jooby/issues

gitlab/maven/io.jooby/jooby/CVE-2020-7622

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) All versions of Jooby are vulnerable to HTTP Response Splitting. if `DefaultHttpHeaders` is set to false.

gitlab/maven/io.jooby/jooby-netty/CVE-2020-7622

Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting) This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

gitlab/maven/org.jooby/jooby/CVE-2020-7622

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Jooby is vulnerable to HTTP Response Splitting if `DefaultHttpHeaders` is set to false.