Ben Kallus comments

Results 93 comments of


                                            Ben Kallus

OLS is vulnerable to request smuggling via requests with multiple `Content-Length` headers

Confirmed fixed in 1.8.2

LiteSpeed is vulnerable to request smuggling by sending both `Content-Length` and `Transfer-Encoding` (i.e., the oldest trick in the book)

(I am reporting this publicly because my previous two reports to the LiteSpeed contact email have not received responses.)

LiteSpeed is vulnerable to request smuggling by sending both `Content-Length` and `Transfer-Encoding` (i.e., the oldest trick in the book)

Confirmed fixed in 1.8.2.

AWS external services removed

We still have AWS CloudFront, but not AWS ALB. This is because ALB stopped working, and I didn't have the time to go fix it. I'll look into bringing it...

AWS external services removed

On second thought, I've been sniped out of too many bounties for this to be worth it to me :) Feel free to provision your own resources for this.

Cheroot incorrectly allows whitespace after header names

> Hi, are you able to come up with a Cheroot-only reproducer? Yes. I can reproduce this on a fresh build from `main` with the following steps: 1. Run this...

OLS is vulnerable to request smuggling via forwarding `\n` without normalization to `\r\n`.

One small update, just to drive the point home: Notice that though Daphne is one of the affected origin servers, it's still in compliance with the RFCs, because the RFCs...

Cheroot cannot send a 400 response for requests with invalid chunked message bodies

Other WSGI servers either automatically close the connection upon receipt of requests with invalid chunked message bodies (Waitress, Tornado) or close the connection automatically when a 400 response is sent...

OLS ignores unrecognized transfer encodings

Confirmed.

Issues in Parsing HTTP Request "Host" Header

> (@kenballus Care to also share your assessment on load balancers getting confused by excessive 1xx reponses to answer the question of whether duplicate Expect: 100-continue processing also needs reconsideration?)...