Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-buxh-55a9-m3bu

Summary

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. This can lead to bypass of security checks. This vulnerability has been patched in '@fastify/reply-from` version 9.6.0.

Aliases

alias	CVE-2023-51701

alias	GHSA-v2v2-hph8-q5xp

Fixed_packages

url	pkg:npm/%40fastify/reply-from@9.6.0
purl	pkg:npm/%40fastify/reply-from@9.6.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/%2540fastify/reply-from@9.6.0

Affected_packages

References

reference_url	https://github.com/fastify/fastify-reply-from/commit/cbd7c17c09e6476268e34f5e499a6b923e8acc18
reference_id
reference_type
scores
url	https://github.com/fastify/fastify-reply-from/commit/cbd7c17c09e6476268e34f5e499a6b923e8acc18

reference_url	https://github.com/fastify/fastify-reply-from/releases/tag/v9.6.0
reference_id
reference_type
scores
url	https://github.com/fastify/fastify-reply-from/releases/tag/v9.6.0

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-51701
reference_id	CVE-2023-51701
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-51701

reference_url	https://github.com/advisories/GHSA-v2v2-hph8-q5xp
reference_id	GHSA-v2v2-hph8-q5xp
reference_type
scores
url	https://github.com/advisories/GHSA-v2v2-hph8-q5xp

reference_url	https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v2v2-hph8-q5xp
reference_id	GHSA-v2v2-hph8-q5xp
reference_type
scores
url	https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v2v2-hph8-q5xp

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	444
name	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
description	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-buxh-55a9-m3bu

Vulnerability Instance