Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

{
                    "collectionURL": "https://repo.hex.pm",
                    "cpes": [
                        "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.Bandit.Pipeline'",
                        "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket'"
                    ],
                    "packageName": "bandit",
                    "packageURL": "pkg:hex/bandit",
                    "product": "bandit",
                    "programFiles": [
                        "lib/bandit/pipeline.ex",
                        "lib/bandit/http1/socket.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.Bandit.Pipeline':determine_host_and_port!/4"
                        },
                        {
                            "name": "'Elixir.Bandit.Pipeline':build_conn!/6"
                        },
                        {
                            "name": "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':resolve_request_target!/2"
                        },
                        {
                            "name": "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':validate_request_line!/2"
                        }
                    ],
                    "repo": "https://github.com/mtrudel/bandit",
                    "vendor": "mtrudel",
                    "versions": [
                        {
                            "lessThan": "1.13.0",
                            "status": "affected",
                            "version": "0.6.0",
                            "versionType": "semver"
                        }
                    ]
                }

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "'Elixir.Bandit.Pipeline'",
                        "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket'"
                    ],
                    "packageName": "mtrudel/bandit",
                    "packageURL": "pkg:github/mtrudel/bandit",
                    "product": "bandit",
                    "programFiles": [
                        "lib/bandit/pipeline.ex",
                        "lib/bandit/http1/socket.ex"
                    ],
                    "programRoutines": [
                        {
                            "name": "'Elixir.Bandit.Pipeline':determine_host_and_port!/4"
                        },
                        {
                            "name": "'Elixir.Bandit.Pipeline':build_conn!/6"
                        },
                        {
                            "name": "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':resolve_request_target!/2"
                        },
                        {
                            "name": "'Elixir.Bandit.HTTPTransport.Bandit.HTTP1.Socket':validate_request_line!/2"
                        }
                    ],
                    "repo": "https://github.com/mtrudel/bandit",
                    "vendor": "mtrudel",
                    "versions": [
                        {
                            "lessThan": "6ea80210137b3f69caf65f67398934259dc365d0",
                            "status": "affected",
                            "version": "0e3edda0edf6322e9164b827c6d3ddecd080ff2e",
                            "versionType": "git"
                        }
                    ]
                }