CVE-2020-7658: Medium severity meinheld meinheld vulnerability

Q: Which deployments are exposed to this issue?

Deployments using meinheld versions earlier than 1.0.2 are affected. The issue is reachable over the network through HTTP request handling.

Q: What does an attacker need to exploit it?

The CVSS vector indicates that no privileges are required, but user interaction is required. Exploitation involves malformed or ambiguous HTTP Content-Length and Transfer-Encoding headers that can enable request smuggling or HTTP pipelining issues.

Q: What should be done to remediate the vulnerability?

Upgrade meinheld to version 1.0.2 or later. The affected range is limited to versions prior to 1.0.2.

Published May 22, 2020

Updated

meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.

Affected Software

2 affected componentsFixes available

pip/meinheld<1.0.2

1.0.2

meinheld meinheld<1.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/meinheld to a version that resolves this vulnerability.
Fixed in 1.0.2

Event History

May 22, 2020

CVE Published

via MITRE·03:48 PM

Data Sourced

via MITRE·03:48 PM

DescriptionWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 24, 2022

Advisory Published

via GitHub·05:18 PM

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using meinheld versions earlier than 1.0.2 are affected. The issue is reachable over the network through HTTP request handling.

What does an attacker need to exploit it?

The CVSS vector indicates that no privileges are required, but user interaction is required. Exploitation involves malformed or ambiguous HTTP Content-Length and Transfer-Encoding headers that can enable request smuggling or HTTP pipelining issues.

What should be done to remediate the vulnerability?

Upgrade meinheld to version 1.0.2 or later. The affected range is limited to versions prior to 1.0.2.

CVE-2020-7658: Medium severity meinheld meinheld vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should be done to remediate the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What should be done to remediate the vulnerability?