GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.
Metrics
Affected Vendors & Products
References
History
Sat, 16 Nov 2024 02:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Redhat rhel Els
|
|
CPEs | cpe:/a:redhat:rhel_e4s:9.0 cpe:/a:redhat:rhel_eus:9.2 cpe:/o:redhat:rhel_els:7 |
|
Vendors & Products |
Redhat rhel Els
|
Thu, 14 Nov 2024 02:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Redhat enterprise Linux
Redhat rhel E4s Redhat rhel Eus Redhat rhel Tus |
|
CPEs | cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/a:redhat:rhel_aus:8.4 cpe:/a:redhat:rhel_aus:8.6 cpe:/a:redhat:rhel_e4s:8.4 cpe:/a:redhat:rhel_e4s:8.6 cpe:/a:redhat:rhel_eus:8.8 cpe:/a:redhat:rhel_eus:9.4 cpe:/a:redhat:rhel_tus:8.4 cpe:/a:redhat:rhel_tus:8.6 cpe:/o:redhat:enterprise_linux:8 |
|
Vendors & Products |
Redhat enterprise Linux
Redhat rhel E4s Redhat rhel Eus Redhat rhel Tus |
Wed, 13 Nov 2024 15:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Redhat
Redhat rhel Aus |
|
CPEs | cpe:/a:redhat:rhel_aus:8.2 | |
Vendors & Products |
Redhat
Redhat rhel Aus |
Tue, 12 Nov 2024 19:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Gnome
Gnome libsoup |
|
CPEs | cpe:2.3:a:gnome:libsoup:*:*:*:*:*:*:*:* | |
Vendors & Products |
Gnome
Gnome libsoup |
|
Metrics |
ssvc
|
Tue, 12 Nov 2024 13:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Title | libsoup: HTTP request smuggling via stripping null bytes from the ends of header names | |
Weaknesses | CWE-444 | |
References |
| |
Metrics |
threat_severity
|
cvssV3_1
|
Mon, 11 Nov 2024 19:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. | |
References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2024-11-11T00:00:00
Updated: 2024-11-12T18:38:07.467Z
Reserved: 2024-11-11T00:00:00
Link: CVE-2024-52530
Vulnrichment
Updated: 2024-11-12T18:37:58.458Z
NVD
Status : Awaiting Analysis
Published: 2024-11-11T20:15:20.247
Modified: 2024-11-12T19:35:14.927
Link: CVE-2024-52530
Redhat