6.3 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): Present (P)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): Low (L)
- Vulnerable System Impact Integrity (VI): Low (L)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): Present (P)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
- Modified Vulnerable System Impact Integrity (MVI): Low (L)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
Activity log
- Created suggestion
Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections
Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. The Mint.HTTP1.decode_body/5 function in lib/mint/http1.ex parses the chunk-size line of a Transfer-Encoding: chunked response with Integer.parse(data, 16). RFC 7230 defines chunk-size = 1*HEXDIG and forbids any sign prefix, but Integer.parse/2 accepts an optional leading + or -. A chunk-size line of +5 is accepted as a five-byte chunk; lines of +0 and -0 are accepted as the terminating zero-length chunk and end the message body early. An RFC-strict intermediary in the response path rejects these forms, so the intermediary and the Mint client disagree on where one response ends and the next begins. On a pooled keep-alive connection, an attacker-influenced origin can inject bytes that the client attributes to the next legitimate response on the same connection, poisoning the response queue and corrupting the responses returned to unrelated in-flight requests. This issue affects mint: from 0.1.0 before 1.9.3.
References
-
https://github.com/elixir-mint/mint/security/advisories/GHSA-x3x7-96vm-6h2w exploitrelatedvendor-advisory
Affected products
- <1.9.3
- <fc7d16538db7e40b56ed489f08683225cb0197fa
Matching in nixpkgs
pkgs.mint
Refreshing language for the front-end web
pkgs.mintotp
Minimal TOTP generator
pkgs.fedimint
Federated E-Cash Mint
pkgs.tendermint
Byzantine-Fault Tolerant State Machines. Or Blockchain, for short
pkgs.garmintools
Provides the ability to communicate with the Garmin Forerunner 305 via the USB interface
pkgs.latexminted
Python executable for LaTeX minted package
pkgs.mint-themes
Mint-X and Mint-Y themes for the cinnamon desktop
pkgs.mint-artwork
Artwork for the cinnamon desktop
pkgs.mint-l-theme
Mint-L theme for the Cinnamon desktop
pkgs.marwaita-mint
Variation for marwaita GTK theme based on linux mint color scheme
pkgs.mint-cursor-themes
Linux Mint cursor themes
pkgs.haskellPackages.mintty
A reliable way to detect the presence of a MinTTY console on Windows
pkgs.octavePackages.optiminterp
Optimal interpolation toolbox for octave
-
nixos-unstable 11.3.0-optiminterp-0.3.7
- nixpkgs-unstable 11.3.0-optiminterp-0.3.7
- nixos-unstable-small 11.3.0-optiminterp-0.3.7
-
nixos-26.05 11.1.0-optiminterp-0.3.7
- nixos-26.05-small 11.1.0-optiminterp-0.3.7
- nixpkgs-26.05-darwin 11.1.0-optiminterp-0.3.7
Package maintainers
-
@dpc Dawid Ciężarkiewicz <dpc@dpc.pw>
-
@romildo José Romildo Malaquias <malaquias@gmail.com>
-
@bobby285271 Bobby Rong <rjl931189261@126.com>
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@provokateurin Kate Döen
-
@ravenjoad Raven Hallsby <raven@hallsby.com>
-
@alexfmpe Alexandre Esteves <alexfmpe@proton.me>