Skip to content

2021-10-12, Version 16.11.1 (Current), @danielleadams
Compare
Choose a tag to compare
@danielleadams danielleadams released this 12 Oct 15:55
v16.11.1
This tag was signed with the committer’s verified signature.
danielleadams Danielle Adams
GPG key ID: D3A89613643B6201
Learn about vigilant mode.
54e0223
This commit was signed with the committer’s verified signature.
danielleadams Danielle Adams
GPG key ID: D3A89613643B6201
Learn about vigilant mode.

This is a security release.

Notable changes

  • CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
    • The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
  • CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
    • The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at CVE-2021-22960 after publication.

Commits

Assets 2
Loading