GHSA-8hxh-r6f7-jf45 Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Not scored Published 16 Oct 2020

A malicious server can exhaust client memory via large compressed responses, causing denial of service in applications using this HTTP client library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-8hxh-r6f7-jf45?

GHSA-8hxh-r6f7-jf45 is a denial of service vulnerability in org.http4s:http4s-async-http-client_2.12, published on 16 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Impact

A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by CVE-2020-11612.

Patches

Upgrade to http4s-async-http-client >= 0.21.8. All 1.0 milestones are also safe.

Workarounds

Add an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:

libraryDependencies ++= Seq(
  &#34;io.netty&#34; %  &#34;netty-codec&#34;         % &#34;4.1.53.Final&#34; % Runtime,
  &#34;io.netty&#34; %  &#34;netty-codec-socks&#34;   % &#34;4.1.53.Final&#34; % Runtime,
  &#34;io.netty&#34; %  &#34;netty-handler-proxy&#34; % &#34;4.1.53.Final&#34; % Runtime,
  &#34;io.netty&#34; %  &#34;netty-common&#34;        % &#34;4.1.53.Final&#34; % Runtime,
  &#34;io.netty&#34; %  &#34;netty-transport&#34;     % &#34;4.1.53.Final&#34; % Runtime,
  &#34;io.netty&#34; %  &#34;netty-handler&#34;       % &#34;4.1.53.Final&#34; % Runtime,
  &#34;io.netty&#34; %  &#34;netty-resolver-dns&#34;  % &#34;4.1.53.Final&#34; % Runtime
)

References

For more information

If you have any questions or comments about this advisory:

Open an issue in http4s
Contact a maintainer privately per http4s' security policy

Which versions are affected by GHSA-8hxh-r6f7-jf45?

4 open source packages ship an affected version, including org.http4s:http4s-async-http-client_2.12 and org.http4s:http4s-async-http-client_2.13.

Package	Affected	Fixed in
`org.http4s:http4s-async-http-client_2.12` Maven	All versions	`0.21.8`
`org.http4s:http4s-async-http-client_2.12` Maven	All versions	`0.21.8`
`org.http4s:http4s-async-http-client_2.13` Maven	All versions	`0.21.8`
`org.http4s:http4s-async-http-client_2.13` Maven	All versions	`0.21.8`

How do I fix GHSA-8hxh-r6f7-jf45?

Upgrade org.http4s:http4s-async-http-client_2.12 to 0.21.8 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is GHSA-8hxh-r6f7-jf45 being exploited?

There is no known exploitation of GHSA-8hxh-r6f7-jf45 in the wild and no public exploit code.