CVE Vulnerabilities

CVE-2018-1000164

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Published: Apr 18, 2018 | Modified: Jun 19, 2019
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
5.3 MODERATE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Ubuntu
LOW

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in process_headers function in gunicorn/http/wsgi.py that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

Weakness

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Affected Software

Name Vendor Start Version End Version
Gunicorn Gunicorn 19.4.5 (including) 19.4.5 (including)
Gunicorn Ubuntu trusty *
Gunicorn Ubuntu trusty/esm *
Gunicorn Ubuntu upstream *
Gunicorn Ubuntu xenial *

Potential Mitigations

References