CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-38165 – lynx: Disclosure of HTTP authentication credentials via SNI data
https://notcve.org/view.php?id=CVE-2021-38165
Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. HTParse en Lynx versiones hasta 2.8.9, maneja inapropiadamente el subcomponente userinfo de un URI, que permite a atacantes remotos descubrir credenciales en texto sin cifrar porque pueden aparecer en los datos SNI o en los encabezados HTTP A flaw was found in the way lynx parsed URLs with userinfo part containing authentication credentials. These credentials were included in the Server Name Indication (SNI) TLS extension data and sent unencrypted during the TLS connection handshake. This could lead to exposure of authentication credentials to attackers able to eavesdrop on network connection between the lynx browser and the server. • http://www.openwall.com/lists/oss-security/2021/08/07/11 http://www.openwall.com/lists/oss-security/2021/08/07/12 http://www.openwall.com/lists/oss-security/2021/08/07/9 https://bugs.debian.org/991971 https://github.com/w3c/libwww/blob/f010b4cc58d32f34b162f0084fe093f7097a61f0/Library/src/HTParse.c#L118 https://lists.debian.org/debian-lts-announce/2021/08/msg00010.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7YMUHFJJWTZ6HBHTYXVDPNZINGGURHDW • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.8EPSS: 5%CPEs: 4EXPL: 0CVE-2010-2810
https://notcve.org/view.php?id=CVE-2010-2810
Heap-based buffer overflow in the convert_to_idna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed URL containing a % (percent) character in the domain name. Desbordamiento de búfer basado en la memoria dinámica en la función convert_to_idna en WWW/Library/Implementation/HTParse.c en Lynx v2.8.8dev.1 hasta v2.8.8dev.4 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posilemete ejecutar código de su elección a través de una URL mal formada qye contiene un caracter % (porcentaje) en el nombre de dominio. • http://marc.info/?l=oss-security&m=128151768510564&w=2 http://marc.info/?l=oss-security&m=128152412221677&w=2 http://www.ubuntu.com/usn/USN-1642-1 http://www.vupen.com/english/advisories/2010/2042 https://bugs.launchpad.net/ubuntu/+source/lynx-cur/+bug/613254 https://exchange.xforce.ibmcloud.com/vulnerabilities/61007 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •