{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4rgh-jx4f-qfcq/GHSA-4rgh-jx4f-qfcq.json"
      },
      "package": {
        "ecosystem": "Pub",
        "name": "http",
        "purl": "pkg:pub/http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.0",
        "0.11.0",
        "0.11.0+1",
        "0.11.1",
        "0.11.1+1",
        "0.11.1+3",
        "0.11.2",
        "0.11.3",
        "0.11.3+1",
        "0.11.3+11",
        "0.11.3+12",
        "0.11.3+13",
        "0.11.3+14",
        "0.11.3+15",
        "0.11.3+16",
        "0.11.3+17",
        "0.11.3+2",
        "0.11.3+3",
        "0.11.3+4",
        "0.11.3+5",
        "0.11.3+6",
        "0.11.3+7",
        "0.11.3+8",
        "0.11.3+9",
        "0.12.0",
        "0.12.0+1",
        "0.12.0+2",
        "0.12.0+3",
        "0.12.0+4",
        "0.12.1",
        "0.12.2",
        "0.13.0",
        "0.13.0-nullsafety.0",
        "0.13.1",
        "0.13.2",
        "0.2.10+1",
        "0.2.7+0",
        "0.2.8+2",
        "0.2.9+7",
        "0.3.1+1",
        "0.3.2",
        "0.3.4",
        "0.3.5+1",
        "0.3.7+6",
        "0.4.0",
        "0.4.1",
        "0.4.2",
        "0.4.3+1",
        "0.4.4+4",
        "0.4.5+1",
        "0.4.7+1",
        "0.5.0+1",
        "0.5.1",
        "0.5.11+1",
        "0.5.12",
        "0.5.13",
        "0.5.14+1",
        "0.5.14+3",
        "0.5.15",
        "0.5.16",
        "0.5.17",
        "0.5.20",
        "0.5.4",
        "0.5.5",
        "0.5.6",
        "0.5.7",
        "0.5.9",
        "0.6.1",
        "0.6.11",
        "0.6.12",
        "0.6.13",
        "0.6.14",
        "0.6.15+2",
        "0.6.15+3",
        "0.6.17",
        "0.6.17+2",
        "0.6.19",
        "0.6.2",
        "0.6.20+1",
        "0.6.21+3",
        "0.6.3+1",
        "0.6.5",
        "0.6.6",
        "0.6.8",
        "0.6.9",
        "0.6.9+2",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.7.2+1",
        "0.7.3+1",
        "0.7.4",
        "0.7.5",
        "0.7.6",
        "0.7.6+4",
        "0.8.0",
        "0.8.1",
        "0.8.10",
        "0.8.10+3",
        "0.8.10+4",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.8.5",
        "0.8.6",
        "0.8.7",
        "0.8.8",
        "0.8.9",
        "0.9.0",
        "0.9.1",
        "0.9.2",
        "0.9.2+1",
        "0.9.2+3"
      ]
    }
  ],
  "aliases": [
    "CVE-2020-35669"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-04T21:05:04Z",
    "nvd_published_at": "2020-12-24T03:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in the http package before 0.13.3 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request via HTTP header injection. This issue has been addressed in commit abb2bb182 by validating request methods.",
  "id": "GHSA-4rgh-jx4f-qfcq",
  "modified": "2023-11-08T04:03:35.243834Z",
  "published": "2022-05-24T17:37:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dart-lang/http/issues/511"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dart-lang/http/pull/512"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dart-lang/http/commit/abb2bb182fbd7f03aafd1f889b902d7b3bdb8769"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dart-lang/http"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dart-lang/http/blob/master/CHANGELOG.md#0133"
    },
    {
      "type": "WEB",
      "url": "https://pub.dev/packages/http/changelog#0133"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "http before 0.13.3 vulnerable to header injection"
}