[
https://issues.apache.org/jira/browse/DIRMINA-1204?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Emmanuel Lécharny resolved DIRMINA-1204.
----------------------------------------
Resolution: Fixed
The framing offsets is now computed in bytes on the raw octet stream.
Found by Claude
Fixed by Maxime Besson
> HTTP Body offset computed in chars, not bytes, desyncs framing
> --------------------------------------------------------------
>
> Key: DIRMINA-1204
> URL: https://issues.apache.org/jira/browse/DIRMINA-1204
> Project: MINA
> Issue Type: Bug
> Components: Protocol - HTTP
> Affects Versions: 2.2.9
> Reporter: Emmanuel Lécharny
> Priority: Major
> Fix For: 2.2.10
>
>
> Behind a connection-reusing front-end that tolerates non-ASCII header bytes
> or whitespace before the header colon, the attacker crafts a request so
> MINA's computed body boundary differs from the front-end's by a chosen number
> of bytes and places a complete smuggled request inside that differential
> window.
> MINA parses the smuggled request as a new top-level request on the shared
> connection; the response queue desyncs for subsequent users.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
