CVE-2024-8912: HTTP Request Smuggling in Looker
An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users.
There are two Looker versions that are hosted by Looker:
Looker (Google Cloud core) was found to be vulnerable. This issue has already been mitigated and our investigation has found no signs of exploitation. Looker (original) was not vulnerable to this issue.
Customer-hosted Looker instances were found to be vulnerable and must be upgraded.
This vulnerability has been patched in all supported versions of customer-hosted Looker, which are available on the Looker download page https://download.looker.com/ .
For Looker customer-hosted instances, please update to the latest supported version of Looker as soon as possible. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page:
23.12 -> 23.12.123+ 23.18 -> 23.18.117+ 24.0 -> 24.0.92+ 24.6 -> 24.6.77+ 24.8 -> 24.8.66+ 24.10 -> 24.10.78+ 24.12 -> 24.12.56+ 24.14 -> 24.14.37+
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8912?
CVE-2024-8912 has been rated with a high severity due to its potential to allow unauthorized attackers to capture HTTP responses.
How do I fix CVE-2024-8912?
To fix CVE-2024-8912, you should upgrade your Looker instance to the latest patched version provided by Looker.
What versions of Looker are affected by CVE-2024-8912?
CVE-2024-8912 affects Looker versions between 23.12.0 and 23.12.123, 23.18.0 and 23.18.117, 24.0.0 and 24.0.92, and several 24.x versions up to 24.14.37.
What type of attack does CVE-2024-8912 enable?
CVE-2024-8912 enables an HTTP Request Smuggling attack that allows an unauthorized user to capture HTTP responses intended for legitimate users.
Can I mitigate CVE-2024-8912 without an update?
While the best practice is to apply updates, you may also implement firewall rules or request filtering as a temporary mitigation for CVE-2024-8912.