Bug 1182059 (CVE-2021-21299) - VUL-0: CVE-2021-21299: rust: request smuggling at hyper crate
Summary: VUL-0: CVE-2021-21299: rust: request smuggling at hyper crate
Status: RESOLVED FIXED
Alias: CVE-2021-21299
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: William Brown
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/277614/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-21299:8.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2021-02-10 15:24 UTC by Alexandros Toptsoglou
Modified: 2022-09-19 10:59 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2021-02-10 15:24:47 UTC
CVE-2021-26959

An issue was discovered in the hyper crate before 0.13.10 and 0.14.x before
0.14.3 for Rust. Request smuggling can occur when more than one
Transfer-Encoding header is sent.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-26959
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26959
https://rustsec.org/advisories/RUSTSEC-2021-0020.html
Comment 1 Alexandros Toptsoglou 2021-02-10 15:30:29 UTC
hyper is included in the rust packages. We ship version 0.12.31. Tracked as affected:
SLE15 and SLE15-SP1 
Factory does not ship hyper.
Comment 2 Alexandros Toptsoglou 2021-02-10 15:31:09 UTC
Additional reference 

https://github.com/hyperium/hyper/security/advisories/GHSA-6hfq-h8hq-87mf
Comment 3 Scott Reeves 2021-03-02 18:36:01 UTC
Federico - can you look into this.
Comment 6 Robert Frohl 2022-08-03 09:49:24 UTC
CVE-2021-26959 was rejected, duplicate of CVE-2021-21299
Comment 7 William Brown 2022-08-04 03:33:19 UTC
I've done a scan for the the related CVE:

- the following pkgs need SECURITY updates to address RUSTSEC-2021-0020 - svc setup
osc bco multimedia:apps/spotifyd
osc bco X11:Wayland/tuigreet
osc bco X11:Wayland/wayshot
 Alternately
 python3 do_bulk_update.py --yolo multimedia:apps/spotifyd X11:Wayland/tuigreet X11:Wayland/wayshot
- the following pkgs need SECURITY updates to address RUSTSEC-2021-0020 - manual, missing cargo_vendor
osc bco Base:System/dracut
osc bco mozilla:Factory/mozjs78
osc bco mozilla:Factory/mozjs91


I am doing the updates for spotify, tuigreet and wayshot. 

The maintainers of dracut and mozjs will need to be contacted to do their own updates of their vendored elements.
Comment 8 Robert Frohl 2022-08-25 08:20:27 UTC
(In reply to William Brown from comment #7)
> I've done a scan for the the related CVE:
> 
> - the following pkgs need SECURITY updates to address RUSTSEC-2021-0020 -
> svc setup
> osc bco multimedia:apps/spotifyd
> osc bco X11:Wayland/tuigreet
> osc bco X11:Wayland/wayshot
>  Alternately
>  python3 do_bulk_update.py --yolo multimedia:apps/spotifyd
> X11:Wayland/tuigreet X11:Wayland/wayshot
> - the following pkgs need SECURITY updates to address RUSTSEC-2021-0020 -
> manual, missing cargo_vendor
> osc bco Base:System/dracut
> osc bco mozilla:Factory/mozjs78
> osc bco mozilla:Factory/mozjs91
> 
> 
> I am doing the updates for spotify, tuigreet and wayshot. 
> 
> The maintainers of dracut and mozjs will need to be contacted to do their
> own updates of their vendored elements.

we also track these as affected:

- SUSE:SLE-15:Update/rust
- SUSE:SLE-15-SP1:Update/rust

Any chance to get a fix there too?
Comment 9 William Brown 2022-08-26 03:09:11 UTC
> > The maintainers of dracut and mozjs will need to be contacted to do their
> > own updates of their vendored elements.
> 
> we also track these as affected:
> 
> - SUSE:SLE-15:Update/rust
> - SUSE:SLE-15-SP1:Update/rust
> 
> Any chance to get a fix there too?

They aren't because request smuggling only affects proxying of responses and the rust complier doesn't do this.

When these RUSTSEC advisories affect rust itself, the rust programming team release seperate fixes and updates.
Comment 10 Carlos López 2022-09-19 10:59:57 UTC
Done, closing.