GHSA-mh24-7wvg-v88g
CRLF Injection in pypiserver
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | pypiserver | < 1.2.6 | 1.2.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a `%0d%0a` in a URI.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-6802
- https://github.com/pypiserver/pypiserver/issues/237
- https://github.com/pypiserver/pypiserver/commit/1375a67c55a9b8d4619df30d2a1c0b239d7357e6
- https://github.com/pypa/advisory-database/tree/main/vulns/pypiserver/PYSEC-2019-113.yaml
- https://github.com/pypiserver/pypiserver