CVE-2021-21299
2 advisories.
crates.io/hyper CVE-2021-21299: medium 4.8, EPSS 4.73%
HTTP Request Smuggling in hyper
Action: Upgrade hyper to 0.12.36 or later.
cargo update -p hyper --precise 0.14.3cargo update -p hyper --precise 0.13.10cargo update -p hyper --precise 0.12.36Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.14.0 | 0.14.3 | - |
| 0.13.0 | 0.13.10 | - |
| 0.12.0 | 0.12.36 | - |
Fixed versions
| 0.14.3 | 0.13.10 | 0.12.36 |
Sources
- osv: GHSA-6hfq-h8hq-87mf
- https://github.com/hyperium/hyper/security/advisories/GHSA-6hfq-h8hq-87mf
- https://nvd.nist.gov/vuln/detail/CVE-2021-21299
- https://github.com/hyperium/hyper/commit/8f93123efef5c1361086688fe4f34c83c89cec02
- https://github.com/hyperium/hyper
- https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
- https://rustsec.org/advisories/RUSTSEC-2021-0020.html
CVE-2021-21299 · published · modified · JSON
crates.io/hyper CVE-2021-21299: high 8.1, EPSS 4.73%
Multiple Transfer-Encoding headers misinterprets request payload
Action: Upgrade hyper to 0.12.36 or later.
cargo update -p hyper --precise 0.12.36cargo update -p hyper --precise 0.13.10cargo update -p hyper --precise 0.14.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.12.0 | 0.12.36 | - |
| 0.13.0-0 | 0.13.10 | - |
| 0.14.0-0 | 0.14.3 | - |
Fixed versions
| 0.12.36 | 0.13.10 | 0.14.3 |
Sources
- osv: RUSTSEC-2021-0020
- https://crates.io/crates/hyper
- https://rustsec.org/advisories/RUSTSEC-2021-0020.html
- https://github.com/hyperium/hyper/commit/8f93123efef5c1361086688fe4f34c83c89cec02
CVE-2021-21299 · published · modified · JSON