Description
http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| http4k | http4k | 4.9.10.0 – < 6.60.0.0 | 6.60.0.0 |
References
- GitHub Security Advisory (GHSA-9xx4-xjpj-xqcf) vendor-advisory
- VulnCheck Advisory: http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity third-party-advisory