ZeroDay Findings
Sign inSign up

Findings

GHSA-jwpw-q68h-r678

Duplicate Advisory: Improper Neutralization of CRLF Sequences in dio

Published May 24, 2022 · updated Nov 29, 2024

## Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-9324-jv53-9cc8. This link is maintained to preserve external references. ## Original Description The dio package prior to 5.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 24, 2022 · GitHub Advisory Database

    Detected

    ## Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-9324-jv53-9cc8. This link is maintained to preserve external references. ## Original Description The dio package prior to 5.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669.

  2. Oct 5, 2023 · GitHub Advisory Database

    Withdrawn

    The advisory was withdrawn.

  3. Nov 29, 2024 · GitHub Advisory Database

    Fix available

    dio fixed in 5.0.0

  4. Nov 29, 2024 · GitHub Advisory Database

    Updated

    ## Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-9324-jv53-9cc8. This link is maintained to preserve external references. ## Original Description The dio package prior to 5.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669.

Affected

  • Pub dio0 → 5.0.0

Sources

References