HTTP Header Injection Affecting eventlet package, versions [,0.37.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-EVENTLET-8136230
- published1 Oct 2024
- disclosed1 Oct 2024
- creditkevin-mizu
Introduced: 1 Oct 2024
CVE NOT AVAILABLE CWE-644 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade eventlet to version 0.37.0 or higher.
Overview
eventlet is a Highly concurrent networking library
Affected versions of this package are vulnerable to HTTP Header Injection via HTTP header processing within the WSGI implementation, allowing the usage of _ in the headers.
By exploiting this vulnerability attackers could craft specially formatted headers, potentially causing header name collisions or overwriting important headers in the WSGI environment.