Homepage
About Snyk

Information Exposure Affecting gevent package, versions [,1.2a1)

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-GEVENT-40735
  • published 4 Dec 2017
  • disclosed 22 Mar 2016
  • credit sean-peters-au
Report a new vulnerability Found a mistake?

Introduced: 22 Mar 2016

CVE NOT AVAILABLE CWE-200 Open this link in a new tab

How to fix?

Upgrade gevent to version 1.2a1 or higher.

Overview

Affected versions of gevent are vulnerable to Information Exposure.

The pywsgi environ dict print the entire WSGI environment by default which could have lead to information Exposure.

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
6.5 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    Low
  • Availability (A)
    None