diff --git a/crates/tiny_http/RUSTSEC-2020-0000.toml b/crates/tiny_http/RUSTSEC-2020-0000.toml new file mode 100644 index 000000000..3b73a61a0 --- /dev/null +++ b/crates/tiny_http/RUSTSEC-2020-0000.toml @@ -0,0 +1,19 @@ +[advisory] +id = "RUSTSEC-2020-0000" +package = "tiny_http" +date = "2020-06-16" +title = "HTTP Request smuggling through malformed Transfer Encoding headers" +url = "https://github.com/tiny-http/tiny-http/issues/173" +keywords = ["http", "request-smuggling"] +description = """ +HTTP pipelining issues and request smuggling attacks are possible due to incorrect +Transfer encoding header parsing. + +It is possible conduct HTTP request smuggling attacks (CL:TE/TE:TE) by sending invalid Transfer Encoding headers. + +By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information +from requests other than their own. +""" + +[versions] +patched = []