CVE-2019-6802: XSS
CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.
Other sources
CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypiserverto a version that resolves this vulnerability.Fixed in 1.2.6
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6802?
CVE-2019-6802 is considered a high severity vulnerability due to its potential for CRLF injection and XSS attacks.
How do I fix CVE-2019-6802?
To mitigate CVE-2019-6802, upgrade pypiserver to version 1.2.6 or later.
What versions are affected by CVE-2019-6802?
CVE-2019-6802 affects pypiserver version 1.2.5 and earlier.
What type of attack is possible with CVE-2019-6802?
CVE-2019-6802 allows attackers to perform CRLF injection attacks, potentially leading to arbitrary HTTP headers manipulation and XSS.
What components are impacted by CVE-2019-6802?
CVE-2019-6802 impacts the pypiserver software, specifically versions 1.2.5 and below.