You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by "kenballus (via GitHub)" <gi...@apache.org> on 2025/01/02 16:44:55 UTC
[I] ATS *still* accepts and forwards carriage returns within chunk-ext BWS [trafficserver]
kenballus opened a new issue, #11935:
URL: https://github.com/apache/trafficserver/issues/11935
#10477 is not fixed.
The repro given in that issue still works. This is a security bug, and is usable for request smuggling when ATS is proxying to llhttp-based servers, such as the one in the Node.js stdlib.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ATS *still* accepts and forwards carriage returns within chunk-ext BWS [trafficserver]
Posted by "maskit (via GitHub)" <gi...@apache.org>.
maskit commented on issue #11935:
URL: https://github.com/apache/trafficserver/issues/11935#issuecomment-2568251275
I guess there was some confusion because there were a couple of similar issues reported. The change I made doesn't seem to work for #10477.
Please do not use GitHub issue if you have any security concerns. I edited the description not to mention software names that could be affected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] ATS *still* accepts and forwards carriage returns within chunk-ext BWS [trafficserver]
Posted by "maskit (via GitHub)" <gi...@apache.org>.
maskit closed issue #11935: ATS *still* accepts and forwards carriage returns within chunk-ext BWS
URL: https://github.com/apache/trafficserver/issues/11935
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org