QID 982989

QID 982989: Java (maven) Security Update for org.http4s:http4s-server_2.12 (GHSA-66q9-f7ff-mmx6)

Security update has been released for org.http4s:http4s-server_2.12 to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

This vulnerability applies to all users of:
* `org.http4s.server.staticcontent.FileService`
* `org.http4s.server.staticcontent.ResourceService`
* `org.http4s.server.staticcontent.WebjarService`

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

In all three services, paths with an empty segment, a `.` segment, or a `..` segment are now rejected with a `400 Bad Request` response. This fixes exposure outside the configured root. Many clients already eliminate dot segments according to the rules in [RFC3986, Section 5.2.4](https://tools.ietf.org/html/rfc3986#section-5.2.4). A middleware that does so at the server level may be considered if there is demand.

If `pathInfo` is non-empty, and does not begin with `/`, then a 404 response is generated. This fixes the prefix matching exposure.

All path segments are URI decoded before being passed to the file system or resource path. This allows resolution of resources with reserved characters in the name, and prevents incorrect exposure of resources whose names are themselves URI encoded.Workaround:
The recommended course is to upgrade:
* v0.18.26, binary compatible with the 0.18.x series
* v0.20.20, binary compatible with the 0.20.x series
* v0.21.2, binary compatible with the 0.21.x series

Note that 0.19.0 is a deprecated release and has never been supported.

If an upgrade is impossible:

* Temporarily copy `FileService.scala`, `ResourceService.scala`, and `WebjarService.scala` from the appropriate release series into your project and recompile with that, changing the package name and reference in your application.
* Users of a servlet backend can use the servlet container's file serving capabilities.

Vendor References

GHSA-66q9-f7ff-mmx6 - github.com/advisories/GHSA-66q9-f7ff-mmx6

CVEs related to QID 982989

CVE-2020-5280 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-66q9-f7ff-mmx6	org.http4s:http4s-server_2.12		github.com/advisories/GHSA-66q9-f7ff-mmx6

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].