Homepage
About Snyk

HTTP Request Smuggling Affecting libhttp-daemon-perl package, versions <6.12-1+deb11u1

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.2% (57th percentile)
Expand this section
NVD
6.5 medium
Expand this section
SUSE
5.3 medium
Expand this section
Red Hat
6.5 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN11-LIBHTTPDAEMONPERL-2936737
  • published 29 Jun 2022
  • disclosed 27 Jun 2022
Report a new vulnerability Found a mistake?

Introduced: 27 Jun 2022

CVE-2022-31081 Open this link in a new tab
CWE-444 Open this link in a new tab

How to fix?

Upgrade Debian:11 libhttp-daemon-perl to version 6.12-1+deb11u1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libhttp-daemon-perl package and not the libhttp-daemon-perl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the HTTP::Daemon. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling my $rqst = $conn-&gt;get_request() one could inspect the returned HTTP::Request object. Querying the 'Content-Length' (my $cl = $rqst-&gt;header(&#39;Content-Length&#39;)) will show any abnormalities that should be dealt with by a 400 response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is 42 or 42, 42, 42). Anything else MUST be rejected.

References