Vulnerable Library - gunicorn-20.1.0-py3-none-any.whl
WSGI HTTP Server for UNIX
Library home page: https://files.pythonhosted.org/packages/e4/dd/5b190393e6066286773a67dfcc2f9492058e9b57c4867a95f1ba5caf0a83/gunicorn-20.1.0-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt
Vulnerabilities
| CVE |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (gunicorn version) |
Remediation Possible** |
| CVE-2024-1135 |
 High |
7.4 |
gunicorn-20.1.0-py3-none-any.whl |
Direct |
gunicorn - 22.0.0 |
❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-1135
Vulnerable Library - gunicorn-20.1.0-py3-none-any.whl
WSGI HTTP Server for UNIX
Library home page: https://files.pythonhosted.org/packages/e4/dd/5b190393e6066286773a67dfcc2f9492058e9b57c4867a95f1ba5caf0a83/gunicorn-20.1.0-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt
Dependency Hierarchy:
- ❌ gunicorn-20.1.0-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
Publish Date: 2024-04-16
URL: CVE-2024-1135
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2024-04-16
Fix Resolution: gunicorn - 22.0.0
Step up your Open Source Security Game with Mend here
WSGI HTTP Server for UNIX
Library home page: https://files.pythonhosted.org/packages/e4/dd/5b190393e6066286773a67dfcc2f9492058e9b57c4867a95f1ba5caf0a83/gunicorn-20.1.0-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - gunicorn-20.1.0-py3-none-any.whl
WSGI HTTP Server for UNIX
Library home page: https://files.pythonhosted.org/packages/e4/dd/5b190393e6066286773a67dfcc2f9492058e9b57c4867a95f1ba5caf0a83/gunicorn-20.1.0-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
Publish Date: 2024-04-16
URL: CVE-2024-1135
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2024-04-16
Fix Resolution: gunicorn - 22.0.0
Step up your Open Source Security Game with Mend here