CVE-2018-1000164 Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers
An attacker can inject arbitrary HTTP headers via CRLF sequences in gunicorn, potentially leading to cache poisoning or security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000164?
CVE-2018-1000164 is a high-severity vulnerability in Debian Debian Linux, published on 18 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.
Weakness: CWE-93
Which versions are affected by CVE-2018-1000164?
3 open source packages ship an affected version, including gunicorn. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
gunicorn PyPI | All versions | 19.5.0 |
gunicorn PyPI | All versions | 19.5.0 |
gunicorn PyPI | All versions | 19.5.0 |
Products include Debian Debian Linux, Gunicorn Gunicorn.
How do I fix CVE-2018-1000164?
Upgrade gunicorn to 19.5.0 or later.
Is CVE-2018-1000164 being exploited?
There is no known exploitation of CVE-2018-1000164 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-1000164, DLA-1357-1, DSA-4186-1, GHSA-32pc-xphx-q4f6, PYSEC-2018-55, UBUNTU-CVE-2018-1000164 and 1 more.