CVE-2020-11724
- State
- Published
- Severity
- Not scored
- Published
- Apr 12, 2020
- Updated
- Aug 4, 2024
- Reserved
- Apr 12, 2020
Description
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://github.com/openresty/openresty/blob/4e8b4c395f842a078e429c80dd063b2323999957/patches/ngx_http_lua-0.10.15-fix_location_capture_content_length_chunked.patch
- https://github.com/openresty/lua-nginx-module/commit/9ab38e8ee35fc08a57636b1b6190dca70b0076fa
- [debian-lts-announce] 20200720 [SECURITY] [DLA 2283-1] nginx security updatemailing-list
- DSA-4750vendor-advisory
- https://security.netapp.com/advisory/ntap-20210129-0002/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.