CVE-2020-7670

Published: Jun 10, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insufficient `Content-Length` and `Transfer Encoding` parsing.

Affected (1)

Products: Ohler: Agoo

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ohler Agoo	Up to 2.12.3

Related CWEs

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (6)

https://github.com/ohler55/agoo/commit/23d03535cf7b50d679a60a953a0cae9519a4a130

Source: report@snyk.io

https://github.com/ohler55/agoo/issues/88

Source: report@snyk.io

https://snyk.io/vuln/SNYK-RUBY-AGOO-569137

Source: report@snyk.io

Third Party Advisory

https://github.com/ohler55/agoo/commit/23d03535cf7b50d679a60a953a0cae9519a4a130

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/ohler55/agoo/issues/88

Source: af854a3a-2127-422b-91ae-364da2661108

https://snyk.io/vuln/SNYK-RUBY-AGOO-569137

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.