HTTP Request Smuggling Affecting libhttp-daemon-perl package, versions *
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN9-LIBHTTPDAEMONPERL-2936747
- published 29 Jun 2022
- disclosed 27 Jun 2022
Introduced: 27 Jun 2022
CVE-2022-31081 Open this link in a new tabHow to fix?
There is no fixed version for Debian:9
libhttp-daemon-perl
.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libhttp-daemon-perl
package and not the libhttp-daemon-perl
package as distributed by Debian
.
See How to fix?
for Debian:9
relevant fixed versions and status.
HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the HTTP::Daemon
. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling my $rqst = $conn->get_request()
one could inspect the returned HTTP::Request
object. Querying the 'Content-Length' (my $cl = $rqst->header('Content-Length')
) will show any abnormalities that should be dealt with by a 400
response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is 42
or 42, 42, 42
). Anything else MUST be rejected.
References
- https://security-tracker.debian.org/tracker/CVE-2022-31081
- https://github.com/libwww-perl/HTTP-Daemon/commit/e84475de51d6fd7b29354a997413472a99db70b2
- https://github.com/libwww-perl/HTTP-Daemon/commit/8dc5269d59e2d5d9eb1647d82c449ccd880f7fd0
- https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
- https://datatracker.ietf.org/doc/html/rfc7230#section-9.5
- https://github.com/libwww-perl/HTTP-Daemon/security/advisories/GHSA-cg8c-pxmv-w7cf
- http://metacpan.org/release/HTTP-Daemon/
- https://cwe.mitre.org/data/definitions/444.html
- https://lists.debian.org/debian-lts-announce/2022/09/msg00038.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U4XEPZ5Q3LNOQF3E6EXFWVSEXU5IZ6T/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQBW2D43TDNYX4R2YBTNNZDBNZ45DINN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECJ4ZPBQWD3B2CD6RRIVMENB5KUOJ3LC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U4XEPZ5Q3LNOQF3E6EXFWVSEXU5IZ6T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECJ4ZPBQWD3B2CD6RRIVMENB5KUOJ3LC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQBW2D43TDNYX4R2YBTNNZDBNZ45DINN/