CVE-2023-41834
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests.
Does this matter?
Lower severity and a low EPSS score (1.61%). Track it; it rarely justifies an emergency change on its own.
Description
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. Users should upgrade to Apache Flink Stateful Functions version 3.3.0.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.61% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-113
- Affected
- apache/flink stateful functions
- Source
- security@apache.org
References
- http://www.openwall.com/lists/oss-security/2023/09/19/3Mailing List, Third Party Advisory
- https://lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrmMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/09/19/3Mailing List, Third Party Advisory
- https://lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrmMailing List, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.