This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-7695 →

DEBIAN-CVE-2020-7695

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit thi...

Original description

The description as published by the source.

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python-uvicorn

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.3-1"}]}]

Debian:13 python-uvicorn

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.3-1"}]}]

Debian:14 python-uvicorn

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.3-1"}]}]

References

advisory security-tracker.debian.org