CVE-2017-18587
headers containing newline characters can split messages
5.3
MEDIUM
CVSS 3.1
EPSS 1.0%
描述
Serializing of headers to the socket did not filter the values for newline bytes (`\r` or `\n`), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input. This issue was fixed by replacing all newline characters with a space during serialization of a header value.
如何修補 CVE-2017-18587
要修補 CVE-2017-18587,請將受影響套件升級到下列已修補版本。
- —升級至 0.10.2 或更新版本
- —升級至 0.9.18 或更新版本
CVE-2017-18587 正在被利用嗎?
低 — EPSS 為 1.0%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- >= 0.10.0, < 0.10.2
- >= 0.0.0-0, < 0.9.18, >= 0.10.0, < 0.10.2
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |