CentOS: Security Advisory for python (CESA-2022:5235)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

python, tkinter security update

CentOS Errata and Security Advisory CESA-2022:5235 An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

HTTP Payload CRLF Injection

A CRLF Injection over HTTP payload vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to change the server's behavior...

GHSA-3CVR-822R-RQCC undici before v5.8.0 vulnerable to CRLF injection in request headers

Impact It is possible to inject CRLF sequences into request headers in Undici. js const undici = require'undici' const response = undici.request"http://127.0.0.1:1000", headers: 'a': "\r\nb" The same applies to path and method Patches Update to v5.8.0 Workarounds Sanitize all HTTP headers from...

undici before v5.8.0 vulnerable to CRLF injection in request headers

Impact It is possible to inject CRLF sequences into request headers in Undici. js const undici = require'undici' const response = undici.request"http://127.0.0.1:1000", headers: 'a': "\r\nb" The same applies to path and method Patches Update to v5.8.0 Workarounds Sanitize all HTTP headers from...

CVE-2022-31150

A flaw was found in the undici package. When requesting an input on an unsanitized request path, method, or headers it is possible to inject Carriage Return/Line Feed CRLF sequences into these requests...

CRLF Injection

undici is vulnerable to CRLF Injection. The vulnerability exists due to the lack of sanitization used in the request path url in the request class of request.js, allowing an attacker to inject and execute malicious request headers when that header contains the \r\n characters...

Zimbra Collaboration CRLF Injection (CVE-2022-27924)

A CRLF injection vulnerability exists in Zimbra Collaboration. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

CVE-2022-31150

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this...

Crlf injection

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this...

CVE-2022-31150

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this...

CVE-2022-31150 CRLF injection in request headers

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this...

CVE-2022-31150 CRLF injection in request headers

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this...

Carriage Return And Line Feed (CLRF) Injection

shescape is vulnerable to carriage return line feed CRLF injection. User provided data for Powershell and cmd.exe on Windows systems are not escaped sufficiently, allowing an attacker to input a line feed character '\n'...

Crlf injection

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...

ASB-A-221859869

In choosePrivateKeyAlias of KeyChain.java, there is a possible access to the user's certificate due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation...

Oracle Linux 7 : python (ELSA-2022-5235)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5235 advisory. - Security fix for CVE-2021-3177 Resolves: rhbz1918168 - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391 Tenable has extracted the...

Scientific Linux Security Update : python on SL7.x i686/x86_64 (2022:5235)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:5235-1 advisory. - python: CRLF injection via HTTP request method in httplib/http.client CVE-2020-26116 - python-urllib3: CRLF injection via HTTP request method...

Moderate: Red Hat Security Advisory: python security update

An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

RHEL 7 : python (RHSA-2022:5235)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5235 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...