gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-gunicorn: Improper neutralization of CRLF Sequences http/wsgi.py:process_headers() can allow an     attacker to cause a server to return arbitrary HTTP headers (CVE-2018-1000164)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to its self-reported version number, the version of Gunicorn installed on the remote host is prior to 19.5.0. It is, therefore, affected by a HTTP response splitting vulnerability in the 'process_headers' function. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that gunicorn improperly handled certain input. An attacker could potentially use this issue execute a cross-site scripting (XSS) attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Everardo reports :

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in process_headers function in gunicorn/http/wsgi.py that can result in an attacker causing the server to return arbitrary HTTP headers.

It was discovered that gunicorn, an event-based HTTP/WSGI server was susceptible to HTTP Response splitting.

It was discovered that there was an issue in the gunicorn HTTP server for Python applicatons where CRLF sequences could result in an attacker tricking the server into returning arbitrary headers.

For more information and background, please see :

https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunico rn-19.4.5

For Debian 7 'Wheezy', this issue has been fixed in gunicorn version 0.14.5-3+deb7u2.

We recommend that you upgrade your gunicorn packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-gunicorn, python3-gunicorn fixes the following issues :

  - CVE-2018-1000164: Improper neutralization of CRLF     Sequences allow tricking the server to return arbitrary     HTTP headers (boo#1088613)

ID	Name	Product	Family	Severity
195695	RHEL 7 : python-gunicorn (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
113024	Gunicorn < 19.5.0 HTTP Response Splitting	Web App Scanning	Component Vulnerability	high
126067	Ubuntu 16.04 LTS : Gunicorn vulnerability (USN-4022-1)	Nessus	Ubuntu Local Security Checks	high
122605	FreeBSD : py-gunicorn -- CWE-113 vulnerability (a3e24de7-3f0c-11e9-87d1-00012e582166)	Nessus	FreeBSD Local Security Checks	high
109415	Debian DSA-4186-1 : gunicorn - security update	Nessus	Debian Local Security Checks	high
109217	Debian DLA-1357-1 : gunicorn security update	Nessus	Debian Local Security Checks	high
109068	openSUSE Security Update : python-gunicorn / python3-gunicorn (openSUSE-2018-369)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-1000164

high

Tenable Plugins

high

high

high

high

high

high

high