CVE-2019-16771: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria
First published: Thu Dec 05 2019(Updated: )
## Multiple timing attack vulnerabilities leading to the recovery of secrets based on the use of non-constant time compare function ### Impact String comparison method in multiple authentication validation in Armeria were known to be vulnerable to timing attacks. This vulnerability is caused by the insecure implementation of `equals` method from `java.lang.String`. While this attack is not practically possible, an attacker still has a potential to attack if the victim's server validates user by using `equals` method. We would like to thank @chrsow for pointing out the issue. ## Potentially vulnerable codes https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/OAuth2Token.java#L54 https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/BasicToken.java#L64 ### Patches There are two options to patch this issue. 1. Remove `equals` method; it has been exclusively used for test cases and was never used in any OSS projects that are using Armeria. (But it is worth noting that there are possibilities of closed projects authenticating users by utilizing `equals` method) 2. Use `MessageDigest.isEqual` to compare the credential instead. ### Workarounds 1. Update to the latest version (TBD) 2-1. Users can prevent these vulnerabilities by modifying and implementing timing attack preventions by themselves. 2-2. Precisely speaking, it is possible to compare credentials by securely comparing them after calling methods to directly return the input (namely `Object. accessToken()`, `Object.username()` and `Object.password()`). ### References - https://cwe.mitre.org/data/definitions/208.html - https://security.stackexchange.com/questions/111040/should-i-worry-about-remote-timing-attacks-on-string-comparison ### Side Note Since it is a theoretical attack, there is no PoC available from neither the vendor nor the security team.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linecorp Armeria | >=0.85.0<0.97.0 | |
| maven/com.linecorp.armeria:armeria | >=0.50.0<0.97.0 | 0.97.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/line/armeria/commit/b597f7a865a527a84ee3d6937075cfbb4470ed20
- https://github.com/line/armeria/security/advisories/GHSA-35fr-h7jr-hh86
- https://github.com/line/armeria/security/advisories/GHSA-24r8-fm9r-cpj2
- https://nvd.nist.gov/vuln/detail/CVE-2019-16771
- https://github.com/advisories/GHSA-24r8-fm9r-cpj2 (Advisory)
Frequently Asked Questions
What is CVE-2019-16771?
CVE-2019-16771 is a vulnerability in Armeria versions 0.85.0 through 0.96.0 that allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response.
What is the severity of CVE-2019-16771?
CVE-2019-16771 has a severity rating of 6.5 (medium).
How can I fix CVE-2019-16771?
To fix CVE-2019-16771, you should update Armeria to version 0.97.0 or later, as this vulnerability has been patched in version 0.97.0.
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-24r8-fm9r-cpj2
- alias/CVE-2019-16771
- agent/software-canonical-lookup
- agent/references
- agent/remedy
- agent/weakness
- agent/severity
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/tags
- agent/event
- vendor/linecorp
- canonical/linecorp armeria
- version/linecorp armeria/0.85.0
- package-manager/maven