Vulnerabilities

 1 via 3 paths

Dependencies

 26

Source

 GitHub

Commit

 db233f7e

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity

HTTP Request Smuggling

  • Vulnerable module: io.vertx:vertx-core
  • Introduced through: io.vertx:vertx-core@4.5.23, io.vertx:vertx-web@4.5.23 and others

Detailed paths

  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents#db233f7eab612c6ab2dc9217c378263ad75be18a › io.vertx:vertx-core@4.5.23
    Remediation: Upgrade to io.vertx:vertx-core@4.5.24.
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents#db233f7eab612c6ab2dc9217c378263ad75be18a › io.vertx:vertx-web@4.5.23 › io.vertx:vertx-bridge-common@4.5.23 › io.vertx:vertx-core@4.5.23
    Remediation: Upgrade to io.vertx:vertx-web@4.5.24.
  • Introduced through: Stwissel/vertx-sfdc-platformevents@Stwissel/vertx-sfdc-platformevents#db233f7eab612c6ab2dc9217c378263ad75be18a › io.vertx:vertx-web-client@4.5.23 › io.vertx:vertx-uri-template@4.5.23 › io.vertx:vertx-core@4.5.23
    Remediation: Upgrade to io.vertx:vertx-web-client@4.5.24.

Overview

io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM.

Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper handling of / in the output buffer by removeDots() function in Static Handler. An attacker can prevent access to static files by sending specifically crafted request URIs that exploit improper handling of encoded path traversal sequences.

Workaround

This vulnerability can be mitigated by disabling the Static Handler cache.

Remediation

Upgrade io.vertx:vertx-core to version 4.5.24 or higher.

References

HTTP Request Smuggling vulnerability report