{"action":"closed","issue":{"url":"https://api.github.com/repos/embedthis/appweb-3/issues/40","labels_url":"https://api.github.com/repos/embedthis/appweb-3/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/embedthis/appweb-3/issues/40/comments","events_url":"https://api.github.com/repos/embedthis/appweb-3/issues/40/events","html_url":"https://github.com/embedthis/appweb-3/issues/40","id":15486896,"number":40,"title":" Incorrect parsing of HTTP Content-Range Header.","user":{"login":"embedthis","id":168175,"avatar_url":"https://avatars.githubusercontent.com/u/168175?v=3","gravatar_id":"","url":"https://api.github.com/users/embedthis","html_url":"https://github.com/embedthis","followers_url":"https://api.github.com/users/embedthis/followers","following_url":"https://api.github.com/users/embedthis/following{/other_user}","gists_url":"https://api.github.com/users/embedthis/gists{/gist_id}","starred_url":"https://api.github.com/users/embedthis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/embedthis/subscriptions","organizations_url":"https://api.github.com/users/embedthis/orgs","repos_url":"https://api.github.com/users/embedthis/repos","events_url":"https://api.github.com/users/embedthis/events{/privacy}","received_events_url":"https://api.github.com/users/embedthis/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/embedthis/appweb-3/milestones/2","html_url":"https://github.com/embedthis/appweb-3/milestones/3.4.3","labels_url":"https://api.github.com/repos/embedthis/appweb-3/milestones/2/labels","id":354513,"number":2,"title":"3.4.3","description":"","creator":{"login":"embedthis","id":168175,"avatar_url":"https://avatars.githubusercontent.com/u/168175?v=3","gravatar_id":"","url":"https://api.github.com/users/embedthis","html_url":"https://github.com/embedthis","followers_url":"https://api.github.com/users/embedthis/followers","following_url":"https://api.github.com/users/embedthis/following{/other_user}","gists_url":"https://api.github.com/users/embedthis/gists{/gist_id}","starred_url":"https://api.github.com/users/embedthis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/embedthis/subscriptions","organizations_url":"https://api.github.com/users/embedthis/orgs","repos_url":"https://api.github.com/users/embedthis/repos","events_url":"https://api.github.com/users/embedthis/events{/privacy}","received_events_url":"https://api.github.com/users/embedthis/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":1,"state":"open","created_at":"2013-06-13T03:27:48Z","updated_at":"2015-09-18T15:39:29Z","due_on":"2013-06-26T07:00:00Z","closed_at":null},"comments":0,"created_at":"2013-06-13T03:27:15Z","updated_at":"2015-09-18T15:39:29Z","closed_at":"2015-09-18T15:39:29Z","body":"#### Description \r\nAppweb 3.X and Appweb 4.X may incorrectly parse a bad Content-Range header and that may provoke a NULL dereference which may abort the Appweb process.\r\n\r\nThe Content-Range header is normally only used in responses and not in requests. But a malicious request may include a Content-Range header which normally would have no effect. Certain Content-Range values may provoke a NULL dereference when a request includes such a corrupt header.\r\n\r\n#### Impact\r\nThis issue may cause an invalid reference and interrupt application service.\r\n\r\n#### Vendor Response\r\nUpgrade to Appweb 3.4.3 or Appweb 4.3.5\r\n\r\n#### Versions Affected\r\nAppweb 3.4.2 and earlier. Appweb 4.3.4 and earlier versions.\r\n\r\n#### Status\r\nFixed\r\n\r\n#### References\r\n* None"}}