// For flags

CVE-2018-1000164

Ubuntu Security Notice USN-4022-1

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

gunicorn 19.4.5 contiene CWE-113: neutralización incorrecta de secuencias CRLF en cabeceras HTTP en la función "process_headers" en "gunicorn/http/wsgi.py" que puede resultar en que un atacante provoque que el servidor devuelva cabeceras HTTP arbitrarias. La vulnerabilidad parece haber sido solucionada en la versión 19.5.0.

It was discovered that gunicorn improperly handled certain input. An attacker could potentially use this issue execute a cross-site scripting attack.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-04-02 CVE Reserved
  • 2018-04-18 CVE Published
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Gunicorn
Search vendor "Gunicorn"
 Gunicorn
Search vendor "Gunicorn" for product "Gunicorn"
 19.4.5
Search vendor "Gunicorn" for product "Gunicorn" and version "19.4.5"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 7.0
Search vendor "Debian" for product "Debian Linux" and version "7.0"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected