You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "Yilialinn (via GitHub)" <gi...@apache.org> on 2024/05/06 01:38:12 UTC
[PR] docs: fix tag of cve-2024-32638.md [apisix-website]
Yilialinn opened a new pull request, #1796:
URL: https://github.com/apache/apisix-website/pull/1796
Fixes: #[Add issue number here]
Changes:
<!-- Add here what changes were made in this pull request and if possible provide links showcasing the changes. -->
Screenshots of the change:
<!-- Add screenshots depicting the changes. -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs: fix tag of cve-2024-32638.md [apisix-website]
Posted by "bzp2010 (via GitHub)" <gi...@apache.org>.
bzp2010 merged PR #1796:
URL: https://github.com/apache/apisix-website/pull/1796
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs: fix tag of cve-2024-32638.md [apisix-website]
Posted by "membphis (via GitHub)" <gi...@apache.org>.
membphis commented on code in PR #1796:
URL: https://github.com/apache/apisix-website/pull/1796#discussion_r1590479433
##########
blog/en/blog/2024/05/02/cve-2024-32638.md:
##########
@@ -1,36 +1,37 @@
---
-title: "Forward-Auth Plugin Request Smuggling( CVE-2024-32638 )"
+title: "HTTP Request Smuggling in forward-auth Plugin (CVE-2024-32638)"
keywords:
- Vulnerability
- forward-auth
- Smuggling
-description: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.
-tags: [Security]
+description: Enabling the `forward-auth` plugin allows Apache APISIX to trigger illegal requests (HTTP Request Smuggling), resulting in a security vulnerability.
+tags: [Vulnerabilities]
+image: https://static.apiseven.com/uploads/2024/05/06/Wq940JRt_CVE-2024-32638.png
---
-> In APISIX 3.8.0, 3.9.0, there is a problem of HTTP Request Smuggling caused by the `forward-auth` plugin.
+> For APISIX versions 3.8.0 and 3.9.0, enabling the forward-auth plugin allows APISIX to trigger illegal requests (HTTP Request Smuggling).
<!--truncate-->
## Problem Description
-Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.
+Enabling the `forward-auth` plugin allows Apache APISIX to trigger illegal requests (HTTP Request Smuggling), resulting in a security vulnerability.
## Affected Versions
-This issue affects Apache APISIX: from 3.8.0, 3.9.0 .
+This risk affects Apache APISIX versions: 3.8.0 and 3.9.0.
Review Comment:
I think `issue` or `vulnerability` is acceptable here
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org