mitmproxy: mitmproxy is an interactive, SSL/TLS-capable intercepting proxy
CVE-2022-24766 is fixed in mitmproxy on 1 platform, first by DEBIAN-CVE-2022-24766, released March 21, 2022. It is not reported as exploited. Patch Radar priority: Urgent.
mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. Unless mitmproxy is used to protect an HTTP/1 service, no action is required. The vulnerability has been fixed in mitmproxy 8.0.0 and above. There are currently no known workarounds.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| mitmproxy · Debian 12.15 (bookworm) | 8.1.1-1 | DEBIAN-CVE-2022-24766 | Mar 21, 2022 |
| mitmproxy · Debian 14 | 8.1.1-1 | DEBIAN-CVE-2022-24766 | Mar 21, 2022 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.