This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to     ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is     to log its details to either the console or a log file. When attackers request crafted URLs with percent-     encoded escape sequences, the logging component will log the URL after it's been processed with     urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character     equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths,     attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use     ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either     in real time or from a file). (CVE-2020-7694)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to
    ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is
    to log its details to either the console or a log file. When attackers request crafted URLs with percent-
    encoded escape sequences, the logging component will log the URL after it's been processed with
    urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character
    equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths,
    attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use
    ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either
    in real time or from a file). (CVE-2020-7694)

ID	Name	Product	Family	Severity
250743	Linux Distros Unpatched Vulnerability : CVE-2020-7694	Nessus	Misc.	high
409243	SCA: security update for uvicorn (GHSA-33c7-2mpw-hg34)	Tenable Cloud Security	SCA Checks	high
409243	SCA: security update for uvicorn (GHSA-33c7-2mpw-hg34)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2020-7694

high

Tenable Plugins

high

high

high