~ / search / GHSA-f97h-2pfx-f59f

GHSA-f97h-2pfx-f59f

HTTP response splitting in uvicorn

Source: GitHub Advisory Database (reviewed) High CVE-2020-7695

Packages

EcosystemPackageAffectedFixed in
PyPI uvicorn < 0.11.7 0.11.7

Details

As written in the advisory (Markdown source, shown as plain text).

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

References

External links from the advisory. They lead to third-party sites.