High severity · published Oct 18, 2019
CVE-2019-17513
An issue was discovered in Ratpack before 1.7.5
7.5
CVSS
2.2%
EPSS
No
On KEV
Description
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Ratpack · Ratpack Project
before 1.7.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17513
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17513
Patch
https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23ae
Patch
https://github.com/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77d
Release Notes
https://github.com/ratpack/ratpack/releases/tag/v1.7.5
Third Party Advisory
https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j
Vendor Advisory
https://ratpack.io/versions/1.7.5
More from Ratpack
8.8
CVE-2021-29485
Ratpack is a toolkit for creating web applications
7.5
CVE-2021-29481
Ratpack is a toolkit for creating web applications
6.1
CVE-2021-29479
Ratpack is a toolkit for creating web applications
3.7
CVE-2019-11808
Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom
3.1
CVE-2021-29480
Ratpack is a toolkit for creating web applications