{"id":"RUSTSEC-2020-0008","summary":"Flaw in hyper allows request smuggling by sending a body in GET requests","details":"Vulnerable versions of hyper allow GET requests to have bodies, even if there is\nno Transfer-Encoding or Content-Length header.  As per the HTTP 1.1\nspecification, such requests do not have bodies, so the body will be interpreted\nas a separate HTTP request.\n\nThis allows an attacker who can control the body and method of an HTTP request\nmade by hyper to inject a request with headers that would not otherwise be\nallowed, as demonstrated by sending a malformed HTTP request from a Substrate\nruntime.  This allows bypassing CORS restrictions.  In combination with other\nvulnerabilities, such as an exploitable web server listening on loopback, it may\nallow remote code execution.\n\nThe flaw was corrected in hyper version 0.12.34.","aliases":["CVE-2020-35863","GHSA-h3qr-rq2j-74w4"],"modified":"2023-11-08T04:03:36.218103Z","published":"2020-03-19T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/hyper"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2020-0008.html"},{"type":"REPORT","url":"https://github.com/hyperium/hyper/issues/1925"}],"affected":[{"package":{"name":"hyper","ecosystem":"crates.io","purl":"pkg:cargo/hyper"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"0.12.34"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"functions":[],"os":[],"arch":[]}},"database_specific":{"categories":["format-injection"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2020-0008.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}