Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers · CVE-2018-1000164 · GitHub Advisory Database · GitHub

Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers

High severity GitHub Reviewed Published Jul 12, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

gunicorn (pip)

Affected versions

< 19.5.0

Patched versions

19.5.0

Description

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

References

Published to the GitHub Advisory Database Jul 12, 2018

Reviewed Jun 16, 2020

Last updated Jan 9, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N