CVE-2018-1000164: CRLF Injection
gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "processheaders" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000164?
CVE-2018-1000164 is classified as a medium severity vulnerability due to the potential for arbitrary HTTP headers to be returned.
How do I fix CVE-2018-1000164?
To fix CVE-2018-1000164, upgrade Gunicorn to version 19.5.0 or later.
What versions of Gunicorn are affected by CVE-2018-1000164?
Gunicorn version 19.4.5 is the only version affected by CVE-2018-1000164.
What are the consequences of exploiting CVE-2018-1000164?
Exploiting CVE-2018-1000164 can allow an attacker to inject arbitrary HTTP headers, potentially leading to session hijacking or other types of attacks.
Is CVE-2018-1000164 specific to any operating systems?
CVE-2018-1000164 affects installations of Gunicorn across various operating systems, particularly those using vulnerable versions in a web server context.