Description
An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | tiny_http | < 0.8.0 | 0.8.0 | GHSA-7v2r-wxmg-mgvc |
| crates.io | tiny_http | >= 0.0.0-0, < 0.6.3 · >= 0.7.0-0, < 0.8.0 | 0.6.3, 0.8.0 | RUSTSEC-2020-0031 |
References
- https://rustsec.org/advisories/RUSTSEC-2020-0031.html
- FEDORA-2021-571e3ed33c vendor-advisory
- FEDORA-2021-c824326120 vendor-advisory