GHSA-w3h3-4rj7-4ph4

Suggest an improvement
Source
https://github.com/advisories/GHSA-w3h3-4rj7-4ph4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-w3h3-4rj7-4ph4/GHSA-w3h3-4rj7-4ph4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w3h3-4rj7-4ph4
Aliases
Related
Published
2024-04-16T00:30:32Z
Modified
2024-12-20T09:37:51.288080Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
Summary
Request smuggling leading to endpoint restriction bypass in Gunicorn
Details

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability has been shown to allow access to endpoints restricted by gunicorn. This issue has been addressed in version 22.0.0.

To be affected users must have a network path which does not filter out invalid requests. These users are advised to block access to restricted endpoints via a firewall or other mechanism if they are unable to update.

Database specific 
{
    "nvd_published_at": "2024-04-16T00:15:07Z",
    "cwe_ids": [
        "CWE-444"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-16T02:54:35Z"
}
References

Affected packages

PyPI / gunicorn

Package

Name
gunicorn
View open source insights on deps.dev
Purl
pkg:pypi/gunicorn

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
22.0.0

Affected versions

0.*

0.1
0.2
0.2.1
0.3
0.3.1
0.3.2
0.4
0.4.1
0.4.2
0.5
0.5.1
0.6
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.7.0
0.7.1
0.7.2
0.8.0
0.8.1
0.9.0
0.9.1
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.12.0
0.12.1
0.12.2
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.14.5
0.14.6
0.15.0
0.16.0
0.16.1
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4

17.*

17.5

18.*

18.0

19.*

19.0.0
19.1.0
19.1.1
19.2.0
19.2.1
19.3.0
19.4.0
19.4.1
19.4.2
19.4.3
19.4.4
19.4.5
19.5.0
19.6.0
19.7.0
19.7.1
19.8.0
19.8.1
19.9.0
19.10.0

20.*

20.0.0
20.0.1
20.0.2
20.0.3
20.0.4
20.1.0

21.*

21.0.0
21.0.1
21.1.0
21.2.0