CVE-2020-7695

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit thi...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2020-7695 python-uvicorn Corrigé dans: 0.13.3-1
Ubuntu UBUNTU-CVE-2020-7695 python-uvicorn

Références

advisory github.com
report snyk.io