CVE-2020-7694: Log Injection
First published: Mon Jul 27 2020(Updated: )
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).
Credit: report@snyk.io report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/uvicorn | <0.11.7 | 0.11.7 |
| Encode Uvicorn |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-7694
- https://github.com/encode/uvicorn
- https://snyk.io/vuln/SNYK-PYTHON-UVICORN-575560
- https://github.com/encode/uvicorn/issues/723
- https://github.com/encode/uvicorn/commit/895807f94ea9a8e588605c12076b7d7517cda503
- https://github.com/advisories/GHSA-33c7-2mpw-hg34 (Advisory)
Frequently Asked Questions
What is CVE-2020-7694?
CVE-2020-7694 is a vulnerability in the uvicorn package that allows for ASNI escape sequence injection in the request logger.
What versions of the uvicorn package are affected?
All versions of the uvicorn package are affected by CVE-2020-7694.
How severe is CVE-2020-7694?
CVE-2020-7694 has a severity rating of 7.5 (High).
How can I fix CVE-2020-7694?
To fix CVE-2020-7694, update the uvicorn package to version 0.11.7 or higher.
What is ASNI escape sequence injection?
ASNI escape sequence injection is a vulnerability where an attacker can inject ASNI escape sequences into an application's logs, potentially leading to various security issues.
- collector/github-advisory-latest
- alias/GHSA-33c7-2mpw-hg34
- alias/CVE-2020-7694
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- package-manager/pip
- vendor/encode
- canonical/encode uvicorn