CVE-2020-35863

An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://rustsec.org/advisories/RUSTSEC-2020-0008.html	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hyper:hyper:*:*:*:*:*:rust:*:*

History

06 Jan 2021, 21:36

Type	Values Removed	Values Added
CPE		cpe:2.3:a:hyper:hyper::::::rust::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.5 v3 : 9.8
CWE		CWE-94
References	~~(MISC) https://rustsec.org/advisories/RUSTSEC-2020-0008.html -~~	(MISC) https://rustsec.org/advisories/RUSTSEC-2020-0008.html - Patch, Third Party Advisory

31 Dec 2020, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2020-12-31 10:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-35863

Mitre link : CVE-2020-35863

CVE.ORG link : CVE-2020-35863

JSON object : View

Products Affected

hyper

hyper

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

{"id": "CVE-2020-35863", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-12-31T10:15:15.097", "references": [{"url": "https://rustsec.org/advisories/RUSTSEC-2020-0008.html", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface."}, {"lang": "es", "value": "Se detect\u00f3 un problema en la crate hyper versiones anteriores a 0.12.34 para Rust. Un tr\u00e1fico no autorizado de peticiones HTTP puede ocurrir. Una ejecuci\u00f3n de c\u00f3digo remota puede ocurrir en determinadas situaciones con un servidor HTTP en la interfaz loopback."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hyper:hyper:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "DDECCA00-7D16-4407-AE0A-B2650B48185E", "versionEndExcluding": "0.12.34"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}