CVE-2021-32714

hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in "request smuggling" or "desync attacks." The vulnerability is patched in version 0.14.10. Two possible workarounds exist. One may reject requests manually that contain a `Transfer-Encoding` header or ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers.

CVSS v3 5.9 MEDIUM
CVSS v2.0 6.4 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9	Exploit Third Party Advisory
https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hyper:hyper:*:*:*:*:*:rust:*:*

History

21 Nov 2024, 06:07

Type	Values Removed	Values Added
CVSS	v2 : ~~6.4~~ v3 : ~~9.1~~	v2 : 6.4 v3 : 5.9
References	~~() https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9 - Exploit, Third Party Advisory~~	() https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9 - Exploit, Third Party Advisory

Information

Published : 2021-07-07 20:15

Updated : 2024-11-21 06:07

NVD link : CVE-2021-32714

Mitre link : CVE-2021-32714

CVE.ORG link : CVE-2021-32714

JSON object : View

Products Affected

hyper

hyper

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2021-32714", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2021-07-07T20:15:08.650", "references": [{"url": "https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in \"request smuggling\" or \"desync attacks.\" The vulnerability is patched in version 0.14.10. Two possible workarounds exist. One may reject requests manually that contain a `Transfer-Encoding` header or ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers."}, {"lang": "es", "value": "hyper es una biblioteca HTTP para Rust. En versiones anteriores a 0.14.10, el c\u00f3digo del servidor y del cliente HTTP de hyper presentaba un fallo que pod\u00eda desencadenar un desbordamiento de enteros cuando se descodifica tama\u00f1os de trozos demasiado grandes. Esto permite una posible p\u00e9rdida de datos, o si es combinado con un proxy HTTP upstream que permite tama\u00f1os de chunk m\u00e1s grandes que hyper, puede resultar en \"request smuggling\" o \"desync attacks\". La vulnerabilidad est\u00e1 parcheada en la versi\u00f3n 0.14.10. Se presentan dos posibles soluciones. Uno puede rechazar manualmente las peticiones que contengan una cabecera \"Transfer-Encoding\" o asegurarse de que cualquier proxy upstream rechaza tama\u00f1os de trozos \"Transfer-Encoding\" superiores a los que caben en enteros sin signo de 64 bits"}], "lastModified": "2024-11-21T06:07:35.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hyper:hyper:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "1A284A7B-4B84-49F0-9EDB-C2B5877217C9", "versionEndExcluding": "0.14.10"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}