HTTP response splitting in Gunicorn - CVE-2018-1000164

Vulnerability identifier: #VU12292

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000164

CWE-ID: CWE-113

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to write arbitrary files on the target system.

The weakness exists in "process_headers" function in "gunicorn/http/wsgi.py" due to improper neutralization of CRLF Sequences in HTTP headers. A remote attacker can cause the server to return arbitrary HTTP headers and write arbitrary files on the target system.

Gunicorn
Debian Linux
Fedora
Ubuntu
gunicorn (Ubuntu package)
gunicorn3 (Ubuntu package)
python-gunicorn (Ubuntu package)
python3-gunicorn (Ubuntu package)
python-gunicorn

Update to version 19.5.0.

gunicorn (Ubuntu package) - update to 19.4.5-1ubuntu1.1
gunicorn3 (Ubuntu package) - update to 19.4.5-1ubuntu1.1
python-gunicorn (Ubuntu package) - update to 19.4.5-1ubuntu1.1
python3-gunicorn (Ubuntu package) - update to 19.4.5-1ubuntu1.1
python-gunicorn - update to 18.0-2.el6

• https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5

• Debian update for gunicorn
• Fedora EPEL 6 update for python-gunicorn
• Ubuntu update for gunicorn