GHSA-63cx-g855-hvv4
mitmproxy binaries embed a vulnerable python-hyper/h2 dependency
Quick fix
GHSA-63cx-g855-hvv4 — mitmproxy: upgrade to the fixed version with the command below.
pip install --upgrade 'mitmproxy>=12.1.2'Details
mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to `http://` backends. It does not affect mitmproxy's regular mode.
All users are encouraged to upgrade to mitmproxy 12.1.2, which includes a fixed version of h2.
More details about the vulnerability itself can be found at https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h.
Are you affected?
Enter the version of the package you're using.