HTTP Request Smuggling Vulnerability in Pound Package
Summary
CVE-2018-21245: Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711. Affects pound versions < 2.8-2. Fixed in 2.8-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pound is an open-source reverse proxy and load balancer designed to enhance web server performance and security. It is widely used for its ability to handle SSL termination and provide advanced routing capabilities. However, prior to version 2.8-2, Pound is susceptible to an HTTP request smuggling vulnerability, which can lead to serious security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2018-21245, allows attackers to exploit the way Pound processes HTTP requests. This can lead to request smuggling, where an attacker can send crafted requests that are improperly parsed by the server. The ramifications include the potential for unauthorized access to sensitive data, session hijacking, and the ability to manipulate server responses. This vulnerability is related to CVE-2016-10711 and poses a significant risk to applications relying on Pound for handling HTTP traffic.
How To Fix
Minimum fixed version
2.8-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade poundTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a web application firewall (WAF) to filter and monitor incoming HTTP requests for anomalies. Additionally, restricting access to the Pound service from untrusted networks can help mitigate the risk until a proper fix is applied.
Conclusion
CVE-2018-21245 is a critical vulnerability affecting the Pound package, allowing for HTTP request smuggling. Users are strongly advised to upgrade to version 2.8-2 or later to mitigate the risks associated with this vulnerability. Implementing workarounds can provide temporary relief, but a permanent fix through upgrading is essential for maintaining application security.
See every vulnerability recorded for pound →
FAQ
CVE-2018-21245 is a vulnerability in the Pound package that allows for HTTP request smuggling, potentially leading to unauthorized access and data manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences include unauthorized access to sensitive information, session hijacking, and the ability to manipulate server responses, which can compromise the integrity of the application.
Yes, implementing a web application firewall (WAF) and restricting access to the Pound service can help mitigate the risk until an upgrade is possible.
The CVSS score for CVE-2018-21245 is 9.1, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for pound.
