CVE-2020-35669: 
NixOS vulnerability analysis and mitigation

An issue was discovered in the http package through 0.12.2 for Dart, identified as CVE-2020-35669. The vulnerability was reported on December 23, 2020, and involves a CRLF injection vulnerability in HTTP requests when the attacker has control over the HTTP method and the application is using the Request functionality directly (CVE Details, NVD).

The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It has received a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity but requiring user interaction. The CVSS v2.0 score is 4.3 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:N/I:P/A:N) (NVD).

The vulnerability allows an attacker to perform CRLF injection in HTTP requests when they have control over the HTTP method. This could potentially lead to header injection and request forgery, particularly concerning in environments using reverse proxies where requests could be redirected to unintended hosts (GitHub Issue).

The vulnerability is exploitable when an attacker can control the HTTP method parameter and the application is using the Request functionality directly. A proof of concept has been documented demonstrating how the vulnerability can be exploited to perform header injection and path forgery (GitHub Issue).

The vulnerability has been addressed in subsequent versions of the http package. Users should upgrade to versions newer than 0.12.2 to mitigate this security issue (NVD).