Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2019-16771

Good to know:

icon
icon

Date: December 6, 2019

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.

Language: Java

Severity Score

Related Resources (6)

https://github.com/advisories/GHSA-24r8-fm9r-cpj2
https://github.com/line/armeria/security/advisories/GHSA-24r8-fm9r-cpj2
https://github.com/line/armeria/commit/b597f7a865a527a84ee3d6937075cfbb4470ed20
https://github.com/line/armeria/security/advisories/GHSA-35fr-h7jr-hh86
https://nvd.nist.gov/vuln/detail/CVE-2019-16771
https://www.mend.io/vulnerability-database/CVE-2019-16771

Severity Score

Weakness Type (CWE)

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CWE-113

Injection

CWE-74

Top Fix

icon

Upgrade Version

Upgrade to version armeria-0.97.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us