CVE-2018-1000164
Publication date 18 April 2018
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in “process_headers” function in “gunicorn/http/wsgi.py” that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.
From the Ubuntu Security Team
It was discovered that gunicorn improperly handled certain input. An attacker could potentially use this issue execute a cross-site scripting (XSS) attack.
Status
Package | Ubuntu Release | Status |
---|---|---|
gunicorn | 22.04 LTS jammy |
Not affected
|
20.04 LTS focal |
Not affected
|
|
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial |
Fixed 19.4.5-1ubuntu1.1
|
|
14.04 LTS trusty |
Fixed 17.5-2ubuntu0.1~esm1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
Patch details
Package | Patch details |
---|---|
gunicorn |
|
Severity score breakdown
Parameter | Value |
---|---|
Base score |
|
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-4022-1
- Gunicorn vulnerability
- 19 June 2019