CVE-2023-41834
Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences
概要
Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser.
Users should upgrade to Apache Flink Stateful Functions version 3.3.0.
参照URL
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com