HTTP Header Injection Affecting eventlet package, versions [,0.37.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-EVENTLET-8136230
- published 1 Oct 2024
- disclosed 1 Oct 2024
- credit kevin-mizu
How to fix?
Upgrade eventlet to version 0.37.0 or higher.
Overview
eventlet is a Highly concurrent networking library
Affected versions of this package are vulnerable to HTTP Header Injection via HTTP header processing within the WSGI implementation, allowing the usage of _ in the headers.
By exploiting this vulnerability attackers could craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment.