Detections
Analytics
Alpine: multiple mitmproxy packages: security update to 7.0.3-r0
critical Tenable Self-Hosted Container Security Plugin ID 427202
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious
client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a
malicious client/server could smuggle a request/response through mitmproxy as part of another
request/response's HTTP message body. While a smuggled request is still captured as part of another
request's body, it does not appear in the request list and does not go through the usual mitmproxy event
hooks, where users may have implemented custom access control checks or input sanitization. Unless one
uses mitmproxy to protect an HTTP/1 service, no action is required. The vulnerability has been fixed in
mitmproxy 7.0.3 and above. (CVE-2021-39214)
See Also
Plugin Details
Severity: Critical
ID: 427202
Version: Revision 1.3
Type: Local
Published: 5/16/2025
Updated: 12/4/2025
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2021-39214
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.3
Threat Score: 8.1
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 9/16/2021
Reference Information
CVE: CVE-2021-39214