CVE Vulnerability

CVE-2019-16771

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/line/armeria/security/advisories/GHSA-35fr-h7jr-hh86 Mailing List Third Party Advisory
https://github.com/line/armeria/commit/b597f7a865a527a84ee3d6937075cfbb4470ed20 Patch Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*
Information

Published : 2019-12-06 07:15

Updated : 2019-12-16 02:19

NVD link : CVE-2019-16771

Mitre link : CVE-2019-16771

Products Affected
No products.
CWE
CWE-74