PyPI: gunicorn
CVE-2018-1000164
Safety vulnerability ID: SFTY-20180418-50233
Safety legacy ID: pyup.io-40105
Gunicorn 19.5.0 includes a fix for CVE-2018-1000164: gunicorn version 19.4.5 contains a CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers.
Overview
Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers
Advisory
Gunicorn 19.5.0 includes a fix for CVE-2018-1000164: gunicorn version 19.4.5 contains a CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20180418-50233/CVE-2018-1000164
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000164
- https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5
- https://github.com/benoitc/gunicorn/issues/1227
- https://lists.debian.org/debian-lts-announce/2018/04/msg00022.html
- https://pypi.org/project/gunicorn
- https://pyup.io/changelogs/gunicorn/
- https://usn.ubuntu.com/4022-1/
- https://www.debian.org/security/2018/dsa-4186
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000164
- https://github.com/benoitc/gunicorn/issues/1227
- https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5
- https://github.com/advisories/GHSA-32pc-xphx-q4f6
- https://lists.debian.org/debian-lts-announce/2018/04/msg00022.html
- https://www.debian.org/security/2018/dsa-4186
- https://github.com/pypa/advisory-database/tree/main/vulns/gunicorn/PYSEC-2018-55.yaml
- https://usn.ubuntu.com/4022-1
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more