by Kastro
Paper/Archive/CVE-2020-7622

CVE-2020-7622

snyk — HTTP Response Splitting

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 75.8.758 × 2015.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

Affected

ProductAffectedFixed inSource
io.jooby:jooby-nettyunspecified – < 1.6.91.6.9CNA
io.jooby:jooby-netty2.0.0 – < unspecifiedunspecifiedCNA
io.jooby:jooby-nettyunspecified – < 2.2.12.2.1CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

refsnyk.io/vuln/SNYK-JAVA-IOJOOBY-564249refgithub.com/jooby-project/jooby/commit/b66e3342cf95205324023cfdf2cb5811e8a6dcf4refgithub.com/jooby-project/jooby/security/advisories/GHSA-gv3v-92v6-m48j