Homepage
About Snyk

gevent@20.5.0 vulnerabilities

Coroutine-based network library

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the gevent package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Race Condition

Affected versions of this package are vulnerable to Race Condition when the fallback socketpair implementation is used on platforms that lack native support and the vulnerable function does not properly authenticate the connected sockets. An attacker must be able to predict the address and port and establish a connection before the legitimate client.

How to fix Race Condition?

Upgrade gevent to version 24.10.1 or higher.

[,24.10.1)
  • H
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected versions of this package are vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') when the gevent.pywsgi function is used. An attacker can craft invalid trailers in chunked requests on keep-alive connections that might appear as two requests to gevent.pywsgi. This could potentially bypass checks if an upstream server is filtering incoming requests based on paths or header fields and simply passing trailers through without validating them.

Note: If the upstream server validated that the trailers meet the HTTP specification, this could not occur, because characters that are required in an HTTP request, like a space, are not allowed in trailers.

How to fix Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')?

Upgrade gevent to version 23.9.0 or higher.

[,23.9.0)
Go back to all versions of this package