Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:2881-1

Опубликовано: 12 авг. 2024
Источник: suse-cvrf

Описание

Security update for python-gunicorn

This update for python-gunicorn fixes the following issues:

  • CVE-2024-1135: Fixed HTTP Request Smuggling due to improperly validate Transfer-Encoding headers (bsc#1222950)

Список пакетов

Image SLES15-SP3-BYOS-Azure
python3-gunicorn-19.7.1-150000.3.7.1
Image SLES15-SP3-HPC-BYOS-Azure
python3-gunicorn-19.7.1-150000.3.7.1
Image SLES15-SP3-SAP-BYOS-Azure
python3-gunicorn-19.7.1-150000.3.7.1
Image SLES15-SP3-SAPCAL-Azure
python3-gunicorn-19.7.1-150000.3.7.1
SUSE Linux Enterprise Module for Public Cloud 15 SP2
python3-gunicorn-19.7.1-150000.3.7.1
SUSE Linux Enterprise Module for Public Cloud 15 SP3
python3-gunicorn-19.7.1-150000.3.7.1
SUSE Linux Enterprise Module for Public Cloud 15 SP4
python3-gunicorn-19.7.1-150000.3.7.1
SUSE Linux Enterprise Module for Public Cloud 15 SP5
python3-gunicorn-19.7.1-150000.3.7.1
SUSE Linux Enterprise Module for Public Cloud 15 SP6
python3-gunicorn-19.7.1-150000.3.7.1
openSUSE Leap 15.5
python-gunicorn-doc-19.7.1-150000.3.7.1
python3-gunicorn-19.7.1-150000.3.7.1

Ссылки

Описание

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.

Затронутые продукты
Image SLES15-SP3-BYOS-Azure:python3-gunicorn-19.7.1-150000.3.7.1
Image SLES15-SP3-HPC-BYOS-Azure:python3-gunicorn-19.7.1-150000.3.7.1
Image SLES15-SP3-SAP-BYOS-Azure:python3-gunicorn-19.7.1-150000.3.7.1
Image SLES15-SP3-SAPCAL-Azure:python3-gunicorn-19.7.1-150000.3.7.1
Ссылки