CVE-2020-7695
Summary
| CVE | CVE-2020-7695 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-07-27 12:15:00 UTC |
| Updated | 2023-01-31 17:26:00 UTC |
| Description | Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers. |
Risk And Classification
Problem Types: CWE-74
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| GitHub - encode/uvicorn: The lightning-fast ASGI server. ???? | MISC | github.com | Third Party Advisory |
| HTTP Response Splitting in uvicorn | Snyk | MISC | snyk.io | Exploit, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Everardo Padilla Saca
Legacy QID Mappings
- 980733 Python (pip) Security Update for uvicorn (GHSA-f97h-2pfx-f59f)