gevent@0.11.2 vulnerabilities

Affected versions of this package are vulnerable to Race Condition when the fallback socketpair implementation is used on platforms that lack native support and the vulnerable function does not properly authenticate the connected sockets. An attacker must be able to predict the address and port and establish a connection before the legitimate client.

Upgrade gevent to version 24.10.1 or higher.

Affected versions of this package are vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') when the gevent.pywsgi function is used. An attacker can craft invalid trailers in chunked requests on keep-alive connections that might appear as two requests to gevent.pywsgi. This could potentially bypass checks if an upstream server is filtering incoming requests based on paths or header fields and simply passing trailers through without validating them.

Note: If the upstream server validated that the trailers meet the HTTP specification, this could not occur, because characters that are required in an HTTP request, like a space, are not allowed in trailers.

Upgrade gevent to version 23.9.0 or higher.

Affected versions of gevent are vulnerable to Information Exposure.

The pywsgi environ dict print the entire WSGI environment by default which could have lead to information Exposure.

Upgrade gevent to version 1.2a1 or higher.