CVE-2015-5285 Kallithea CRLF injection vulnerability
Remote attackers can inject HTTP headers and split responses via the login parameter, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-5285?
CVE-2015-5285 is a medium-severity vulnerability in n/a, published on 29 Oct 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.
Which versions are affected by CVE-2015-5285?
3 open source packages ship an affected version, including kallithea. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kallithea PyPI | All versions | 0.3 |
kallithea PyPI | All versions | 0.3 |
kallithea PyPI | All versions | 0.3 |
Products include Kallithea-Scm Kallithea.
How do I fix CVE-2015-5285?
Upgrade kallithea to 0.3 or later.
Is CVE-2015-5285 being exploited?
There is no known exploitation of CVE-2015-5285 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vfg9-phjp-9frw, PYSEC-2015-13.