GHSA-mh24-7wvg-v88g

Source

https://github.com/advisories/GHSA-mh24-7wvg-v88g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-mh24-7wvg-v88g/GHSA-mh24-7wvg-v88g.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-mh24-7wvg-v88g

Aliases

Published

2019-01-30T20:56:26Z

Modified

2024-10-16T03:01:47.673545Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

CRLF Injection in pypiserver

Details

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.

Database specific

{
    "nvd_published_at": "2019-01-25T04:29:00Z",
    "cwe_ids": [
        "CWE-74",
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:46:14Z"
}

References

Affected packages

PyPI / pypiserver

Package

Name: pypiserver; View open source insights on deps.dev
Purl: pkg:pypi/pypiserver

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.6

Affected versions

0.*

0.1.0

0.1.1

0.1.2

0.1.3

0.2.0

0.3.0

0.4.0

0.4.1

0.5.0

0.5.1

0.5.2

0.6.0

0.6.1

1.*

1.0.0

1.0.1

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7-rc.1

1.1.7

1.1.8b0

1.1.8b1

1.1.8

1.1.9.dev0

1.1.9.dev1

1.1.9.dev2

1.1.9

1.1.10

1.2.0.dev1

1.2.0b1

1.2.0

1.2.1.dev0

1.2.1rc0

1.2.1

1.2.2.dev0

1.2.2

1.2.3

1.2.4

1.2.5

Database specific

{
    "last_known_affected_version_range": "<= 1.2.5"
}