GHSA-32pc-xphx-q4f6

Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000164

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	gunicorn	< 19.5.0	19.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000164 advisory
https://github.com/benoitc/gunicorn/issues/1227 web
https://github.com/benoitc/gunicorn/commit/1e10a02e73c87dfadc394b361af33864d0e59e24 web
https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5 web
https://github.com/benoitc/gunicorn package
https://github.com/pypa/advisory-database/tree/main/vulns/gunicorn/PYSEC-2018-55.yaml web
https://lists.debian.org/debian-lts-announce/2018/04/msg00022.html web
https://usn.ubuntu.com/4022-1 web
https://www.debian.org/security/2018/dsa-4186 web