CVE-2020-7655 HTTP Request Smuggling in netius
Attackers can exploit HTTP request smuggling in the netius library to bypass security controls or access sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-7655?
CVE-2020-7655 is a medium-severity vulnerability in netius, published on 21 May 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.
Weakness: CWE-444
Which versions are affected by CVE-2020-7655?
3 open source packages ship an affected version, including netius. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
netius PyPI | All versions | 1.17.58 |
netius PyPI | All versions | 1.17.58 |
netius PyPI | All versions | 1.17.58 |
Products include Hive Netius.
How do I fix CVE-2020-7655?
Upgrade netius to 1.17.58 or later.
Is CVE-2020-7655 being exploited?
There is no known exploitation of CVE-2020-7655 in the wild and no public exploit code.
Sources
Also known as GHSA-wm2m-xrrp-j74c, PYSEC-2020-242, SNYK-PYTHON-NETIUS-569141.