GitHub Advisoryadvisory · PyPI
GHSA-wm2m-xrrp-j74c HTTP Request Smuggling in netius
MEDIUM
Official page ↗
- Aliases
- CVE-2020-7655
- Ecosystem
- PyPI
- Packages
- netius
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-444
- Reviewed
- 2021-05-14
Affected packages
• PyPI netius: < 1.17.58 → fixed in 1.17.58
Description
netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.
Related
Alias · CVE (1)
- CVE-2020-7655 netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. vulnerability
Weakness · CWE (1)
- CWE-444 Inconsistent Interpretation of HTTP Requests weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7655 advisory
- https://github.com/hivesolutions/netius/commit/9830881ef68328f8ea9c7901db1d11690677e7d1 web
- https://github.com/advisories/GHSA-wm2m-xrrp-j74c advisory
- https://github.com/hivesolutions/netius package
- https://github.com/pypa/advisory-database/tree/main/vulns/netius/PYSEC-2020-242.yaml web
- https://snyk.io/vuln/SNYK-PYTHON-NETIUS-569141 web