Received-SPF: pass (google.com: domain of oss-security-return-30109-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
MIME-Version: 1.0
From: YuanSheng Wang <membphis@apache.org>
Date: Thu, 2 May 2024 17:15:10 +0800
Message-ID: <CAKzgDd3JhyCMip9hKAAHaobS=n0u+ifB=qK74RT=3P25t2xuEg@mail.gmail.com>
To: announce@apache.org, "dev@apisix.apache.org" <dev@apisix.apache.org>, 
	Apache Security Team <security@apache.org>, oss-security@lists.openwall.com, 
	Brandon Arp <brandonarp@gmail.com>
Content-Type: multipart/alternative; boundary="0000000000005c2ecf0617750c03"
Subject: [oss-security] CVE-2024-32638: Apache APISIX: Forward-Auth Request Smuggling

--0000000000005c2ecf0617750c03
Content-Type: text/plain; charset="UTF-8"

Severity: low

Affected versions:

- Apache APISIX 3.8.0, 3.9.0

Description:

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
vulnerability in Apache APISIX when using `forward-auth` plugin.

This issue affects Apache APISIX: from 3.8.0, 3.9.0 .

Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which
fixes the issue.

Credit:

Discovered and reported by Brandon Arp and Bruno Green of Topsort.

Regards.

-- 

*MembPhis*
My GitHub: https://github.com/membphis
Apache APISIX: https://github.com/apache/apisix

--0000000000005c2ecf0617750c03--