GitHub Advisoryadvisory · PyPI

GHSA-f97h-2pfx-f59f HTTP response splitting in uvicorn

HIGH Published 2020-07-29 Modified 2024-11-18 Official page ↗
Aliases
CVE-2020-7695
Ecosystem
PyPI
Packages
uvicorn
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-74
Reviewed
2020-07-29

Affected packages

• PyPI uvicorn: < 0.11.7 → fixed in 0.11.7

Description

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

Related

Alias · CVE (1)

  • CVE-2020-7695 Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References