GHSA-wm2m-xrrp-j74c

HTTP Request Smuggling in netius

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7655

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	netius	< 1.17.58	1.17.58

Details

As written in the advisory (Markdown source, shown as plain text).

netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7655 advisory
https://github.com/hivesolutions/netius/commit/9830881ef68328f8ea9c7901db1d11690677e7d1 web
https://github.com/advisories/GHSA-wm2m-xrrp-j74c advisory
https://github.com/hivesolutions/netius package
https://github.com/pypa/advisory-database/tree/main/vulns/netius/PYSEC-2020-242.yaml web
https://snyk.io/vuln/SNYK-PYTHON-NETIUS-569141 web