GHSA-63h2-9cc8-fc7m

meinheld vulnerable to HTTP Request Smuggling

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7658

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	meinheld	< 1.0.2	1.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7658 advisory
https://github.com/mopemope/meinheld/issues/111 web
https://github.com/mopemope/meinheld/commit/0cfa70b2cd3800f1e4beeaef5421b156d90f0e09 web
https://github.com/mopemope/meinheld/commit/3bc3e7ccd534277af955c0c92981d0aa033929a7 web
https://github.com/mopemope/meinheld/commit/4155876bfd3e8fc4adad4aaa59ec3f1cefa1d2d1 web
https://github.com/mopemope/meinheld package
https://github.com/mopemope/meinheld/blob/master/CHANGES.rst web
https://github.com/pypa/advisory-database/tree/main/vulns/meinheld/PYSEC-2020-239.yaml web
https://snyk.io/vuln/SNYK-PYTHON-MEINHELD-569140 web