CVE-2021-32643
Description
Http4s is a Scala interface for HTTP services. StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns F[None], indicating no resource, if url.getFile is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The patch is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling StaticFile.fromUrl with non-file URLs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.http4s:http4s-coreMaven | >= 0.21.7, < 0.21.24 | 0.21.24 |
org.http4s:http4s-coreMaven | >= 0.22.0-M1, < 0.22.0-RC1 | 0.22.0-RC1 |
org.http4s:http4s-coreMaven | >= 0.23.0-M1, < 0.23.0-RC1 | 0.23.0-RC1 |
org.http4s:http4s-coreMaven | >= 1.0.0-M1, < 1.0.0-M23 | 1.0.0-M23 |
Affected products
34- http4s/http4sv5Range: >= 0.21.7, < 0.21.24
cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*+ 31 more
- cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*range: >=0.21.7,<0.21.24
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone1:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone2:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone3:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone4:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone5:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone6:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone7:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:0.22.0:milestone8:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:0.23.0:milestone1:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*
- cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
5- github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9nvdPatchThird Party AdvisoryWEB
- github.com/http4s/http4s/security/advisories/GHSA-6h7w-fc84-x7p6nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-6h7w-fc84-x7p6ghsaADVISORY
- mvnrepository.com/artifact/org.http4s/http4s-corenvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-32643ghsaADVISORY
News mentions
0No linked articles in our index yet.