CVE-2013-7299 framework/common/messageheaderparser.cpp in Tntnet before 2.2.1 allows remote attackers to obtain sensitive information via a header that ends in \n instead of \r\n, which prevents a null terminator f...
MediumCVSS 5.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
framework/common/messageheaderparser.cpp in Tntnet before 2.2.1 allows remote attackers to obtain sensitive information via a header that ends in \n instead of \r\n, which prevents a null terminator from being added and causes Tntnet to include headers from other requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/tntnet(Debian:13) | < 2.2.1-1 | 2.2.1-1 |
| tntnet | <= 2.2 | No fix listed |
| tntnet | = 2.0 | No fix listed |
| tntnet | = 2.1 | No fix listed |
References
- Debian Security Tracker CVE-2013-7299 vendor-advisory
- FEDORA-2014-1619 vendor-advisory
- [oss-security] 20140118 CVE requests / advisory: cxxtools <= 2.2, Tntnet <= 2.2 mailing-list
- [oss-security] 20140118 Re: CVE requests / advisory: cxxtools <= 2.2, Tntnet <= 2.2 mailing-list
- 56400 third-party-advisory vendor-advisory
- 65025 vdb-entry
- www.tntnet.org
- cxxtools-cve20137299-session-hijacking(90565) vdb-entry
- github.com patch
- bugs.debian.org issue-tracking