What is the severity of CVE-2020-35669?

CVE-2020-35669 has been classified as a high-severity vulnerability due to its potential for CRLF injection.

How do I fix CVE-2020-35669?

To fix CVE-2020-35669, update the Dart http package to the latest version beyond 0.12.2.

What is CRLF injection related to CVE-2020-35669?

CRLF injection allows an attacker to manipulate HTTP headers through injected carriage return (CR) and line feed (LF) characters.

Which versions of the Dart http package are affected by CVE-2020-35669?

CVE-2020-35669 affects the Dart http package versions up to and including 0.12.2.

How can I tell if my application is vulnerable to CVE-2020-35669?

If your application is using the Dart http package version 0.12.2 or earlier and directly using the Request class, it may be vulnerable to CVE-2020-35669.

Vulnerability/
CVE-2020-35669

medium

6.1

CWE

74 93

24/12/2020

4/8/2024

CVE-2020-35669: CRLF Injection

First published: Thu Dec 24 2020(Updated: )

An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Dart Http	<=0.12.2

Remedy

https://github.com/dart-lang/http/issues/511

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2020-35669?
CVE-2020-35669 has been classified as a high-severity vulnerability due to its potential for CRLF injection.
How do I fix CVE-2020-35669?
To fix CVE-2020-35669, update the Dart http package to the latest version beyond 0.12.2.
What is CRLF injection related to CVE-2020-35669?
CRLF injection allows an attacker to manipulate HTTP headers through injected carriage return (CR) and line feed (LF) characters.
Which versions of the Dart http package are affected by CVE-2020-35669?
CVE-2020-35669 affects the Dart http package versions up to and including 0.12.2.
How can I tell if my application is vulnerable to CVE-2020-35669?
If your application is using the Dart http package version 0.12.2 or earlier and directly using the Request class, it may be vulnerable to CVE-2020-35669.

collector/nvd-index
agent/references
agent/type
collector/mitre-cve
source/MITRE
agent/severity
agent/author
agent/remedy
agent/weakness
agent/last-modified-date
agent/softwarecombine
agent/description
agent/first-publish-date
agent/event
agent/tags
agent/source
vendor/dart
canonical/dart http
version/dart http/0.12.2

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2020-35669?
CVE-2020-35669 has been classified as a high-severity vulnerability due to its potential for CRLF injection.
How do I fix CVE-2020-35669?
To fix CVE-2020-35669, update the Dart http package to the latest version beyond 0.12.2.
What is CRLF injection related to CVE-2020-35669?
CRLF injection allows an attacker to manipulate HTTP headers through injected carriage return (CR) and line feed (LF) characters.
Which versions of the Dart http package are affected by CVE-2020-35669?
CVE-2020-35669 affects the Dart http package versions up to and including 0.12.2.
How can I tell if my application is vulnerable to CVE-2020-35669?
If your application is using the Dart http package version 0.12.2 or earlier and directly using the Request class, it may be vulnerable to CVE-2020-35669.