GitHub Advisoryadvisory · PyPI

GHSA-66x7-2r56-fj77 Buildbot CRLF Injection

MEDIUM Published 2022-05-14 Modified 2024-09-13 Official page ↗
Aliases
CVE-2019-7313
Ecosystem
PyPI
Packages
buildbot
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-93
Reviewed
2023-07-19

Affected packages

• PyPI buildbot: >= 0.9.0, < 1.8.1 → fixed in 1.8.1

Description

`www/resource.py` in Buildbot before 1.8.1 allows CRLF injection in the Location header of `/auth/login` and `/auth/logout` via the redirect parameter. This affects other web sites in the same domain.

Related

Alias · CVE (1)

  • CVE-2019-7313 www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect… vulnerability

Weakness · CWE (1)

  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References