CVE-2020-7695 (High) detected in uvicorn-0.11.1.tar.gz

[mend-bolt-for-github]

CVE-2020-7695 - High Severity Vulnerability

Vulnerable Library - uvicorn-0.11.1.tar.gz

The lightning-fast ASGI server.

Library home page: https://files.pythonhosted.org/packages/34/f3/b4a12c64d2b447393099f669b2041b345510f548de6dd458977cd9546208/uvicorn-0.11.1.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ uvicorn-0.11.1.tar.gz (Vulnerable Library)

Vulnerability Details

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

Publish Date: 2020-07-27

URL: CVE-2020-7695

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-29

Fix Resolution: 0.11.7

---

Step up your Open Source Security Game with Mend here