CVE-2024-32638 - OpenCVE

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Apache Software Foundation	Apache Apisix

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/05/02/2
https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-05-02T09:20:29.127Z

Updated: 2024-08-02T02:13:40.364Z

Reserved: 2024-04-16T11:56:04.600Z

Link: CVE-2024-32638

Vulnrichment

Updated: 2024-05-02T13:39:29.693Z

NVD

Status : Awaiting Analysis

Published: 2024-05-02T10:15:08.443

Modified: 2024-07-03T01:56:53.103

Link: CVE-2024-32638

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32638", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-04-16T11:56:04.600Z", "datePublished": "2024-05-02T09:20:29.127Z", "dateUpdated": "2024-08-02T02:13:40.364Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache APISIX", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.9.0", "status": "affected", "version": "3.8.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Discovered and reported by Brandon Arp and Bruno Green of Topsort."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')</span> vulnerability in Apache APISIX when using `forward-auth` plugin.<p>This issue affects Apache APISIX: from 3.8.0, 3.9.0.</p><p>Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.</p>"}], "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')\u00a0vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0.\n\nUsers are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.\n\n"}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-05-02T09:20:29.127Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov"}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/2"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache APISIX: Forward-Auth Request Smuggling", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-32638", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-02T13:37:37.631816Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache_software_foundation:Apache_APISIX:3.8.0:*:*:*:*:*:*:*"], "vendor": "apache_software_foundation", "product": "Apache_APISIX", "versions": [{"status": "affected", "version": "3.8.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:51:36.154Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:13:40.364Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov"}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/2", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32638", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-04-16T11:56:04.600Z", "datePublished": "2024-05-02T09:20:29.127Z", "dateUpdated": "2024-06-04T17:51:36.154Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache APISIX", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.9.0", "status": "affected", "version": "3.8.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Discovered and reported by Brandon Arp and Bruno Green of Topsort."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')</span> vulnerability in Apache APISIX when using `forward-auth` plugin.<p>This issue affects Apache APISIX: from 3.8.0, 3.9.0.</p><p>Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.</p>"}], "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')\u00a0vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0.\n\nUsers are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.\n\n"}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-05-02T09:20:29.127Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov"}, {"url": "http://www.openwall.com/lists/oss-security/2024/05/02/2"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache APISIX: Forward-Auth Request Smuggling", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-32638", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-02T13:37:37.631816Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache_software_foundation:Apache_APISIX:3.8.0:*:*:*:*:*:*:*"], "vendor": "apache_software_foundation", "product": "Apache_APISIX", "versions": [{"status": "affected", "version": "3.8.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-02T13:39:29.693Z"}, "title": "CISA ADP Vulnrichment"}]}}