CVE-2018-1000164
Summary
| CVE | CVE-2018-1000164 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-04-18 19:29:00 UTC |
|---|
| Updated | 2019-06-19 22:15:00 UTC |
|---|
| Description | gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| USN-4022-1: Gunicorn vulnerability | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
|
| [SECURITY] [DLA 1357-1] gunicorn security update |
MLIST |
lists.debian.org |
Third Party Advisory |
| HTTP header splitting in gunicorn 19.4.5 |
MISC |
epadillas.github.io |
Exploit, Third Party Advisory |
| Potential HTTP Response Splitting Vulnerability · Issue #1227 · benoitc/gunicorn · GitHub |
MISC |
github.com |
Exploit, Issue Tracking, Third Party Advisory |
| Debian -- Security Information -- DSA-4186-1 gunicorn |
DEBIAN |
www.debian.org |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981399 Python (pip) Security Update for gunicorn (GHSA-32pc-xphx-q4f6)
