CVE-2020-7695

Опубликовано: 27 июл. 2020

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

Ссылки

https://github.com/encode/uvicorn
Third Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471
Exploit
Third Party Advisory
https://github.com/encode/uvicorn
Third Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:encode:uvicorn:*:*:*:*:*:*:*:*

Версия до 0.11.7 (исключая)

EPSS

Процентиль: 53%

0.003

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-74

Связанные уязвимости

CVE-2020-7695

CVSS3: 5.3

ubuntu

больше 5 лет назад

CVE-2020-7695

CVSS3: 5.3

debian

больше 5 лет назад

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF s ...

GHSA-f97h-2pfx-f59f

CVSS3: 7.5

github

больше 5 лет назад

HTTP response splitting in uvicorn

EPSS

Процентиль: 53%

0.003

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-74