CVE-2020-7658 meinheld vulnerable to HTTP Request Smuggling
Attackers can exploit HTTP request smuggling via incorrect header parsing in the meinheld server, potentially bypassing security controls or accessing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-7658?
CVE-2020-7658 is a medium-severity vulnerability in meinheld, published on 22 May 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.
Weakness: CWE-444
Which versions are affected by CVE-2020-7658?
3 open source packages ship an affected version, including meinheld. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
meinheld PyPI | All versions | 1.0.2 |
meinheld PyPI | All versions | 1.0.2 |
meinheld PyPI | All versions | 1.0.2 |
Products include Meinheld Meinheld.
How do I fix CVE-2020-7658?
Upgrade meinheld to 1.0.2 or later.
Is CVE-2020-7658 being exploited?
There is no known exploitation of CVE-2020-7658 in the wild and no public exploit code.
Sources
Also known as GHSA-63h2-9cc8-fc7m, PYSEC-2020-239, SNYK-PYTHON-MEINHELD-569140.