EUVD-2019-0061

Malware in sbrugna...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

invenio-app-rdm (>=10.0.0.dev15, <=11.0.0.dev1), invenio-theme-tugraz (4.11.0) +4 more potentially affected by unknown CVE via invenio-communities (>=3.2.2, <=4.2.1)

invenio-communities PYPI version =3.2.2, =10.0.0.dev15, =1.0.40, =11.0.3, =4.0.2, =4.0.22, =4.0.42 Source cves: unknown CVE Source advisory: OSV:GHSA-HJX6-F647-MVF9...

invenio-app-rdm (>=10.0.0.dev15, <=11.0.0.dev1), invenio-theme-tugraz (4.11.0) +4 more potentially affected by unknown CVE via invenio-communities (>=3.2.2, <=4.2.1)

invenio-communities PYPI version =3.2.2, =10.0.0.dev15, =1.0.40, =11.0.3, =4.0.2, =4.0.22, =4.0.42 Source cves: unknown CVE Source advisory: GHSA-HJX6-F647-MVF9...

invenio-app-rdm (>=12.0.0.dev0, <=12.0.0b2.dev0), invenio-dnb-urn (0.2.2) +2 more potentially affected by unknown CVE via invenio-communities (>=5.1.0, <=7.7.3)

invenio-communities PYPI version =5.1.0, =12.0.0.dev0, =4.10.0, =11.0.17, =12.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-HJX6-F647-MVF9...

invenio-app-rdm (>=12.0.0.dev0, <=12.0.0b2.dev0), invenio-dnb-urn (0.2.2) +2 more potentially affected by unknown CVE via invenio-communities (>=5.1.0, <=7.7.3)

invenio-communities PYPI version =5.1.0, =12.0.0.dev0, =4.10.0, =11.0.17, =12.0.3 Source cves: unknown CVE Source advisory: GHSA-HJX6-F647-MVF9...

Host Header Injection

invenio-app is vulnerable to host header injection. The attack exists because it only relies on APPALLOWEDHOSTS to whitelist allowed host headers, misconfiguring the web server to allow requests with any host header...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

PYSEC-2019-94

invenio-app before 1.1.1 allows host header injection...

invenio (>=3.0.0rc1, <=3.1.0.dev20181106) potentially affected by CVE-2019-1020006 via invenio-app (1.0.6)

invenio-app PYPI version 1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on invenio-app and may be impacted: - invenio =3.0.0rc1, =3.1.0.dev20181106 Source cves: CVE-2019-1020006 Source advisory: OSV:PYSEC-2019-24...

PYSEC-2019-24

invenio-app before 1.1.1 allows host header injection...

PYSEC-2019-24

invenio-app before 1.1.1 allows host header injection...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

CVE-2019-1020006

CVE-2019-1020006 affects invenio-app prior to 1.1.1 and allows host header injection due to insufficient validation of host headers via APP_ALLOWED_HOSTS. Multiple sources corroborate a host header injection risk in Invenio-App before the patched versions. The Red Hat advisory reiterates the same...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

PT-2019-20175

Name of the Vulnerable Software and Affected Versions Invenio-App versions prior to 1.1.1 Description The issue allows for host header injection. Recommendations For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue...

CVE-2019-1020006: Improper Neutralization of Special Elements in Output Used by a Downstream Component

invenio-app before 1.1.1 allows host header injection...

GHSA-94MF-XFG5-R247 Invenio-App vulnerable to host header injection attack

APPALLOWEDHOSTS not always preventing host header injection Impact A possible host header injection attack have been identified in Invenio-App. For an attack to be possible, all conditions below must be met: 1. Your webserver must have been configured to route all requests to your application. 2...

PT-2019-11622

Name of the Vulnerable Software and Affected Versions: Invenio-App versions prior to 1.1.1 Description: A host header injection attack has been identified in Invenio-App. This issue can be exploited if the web server is configured to route all requests to the application, the APP ALLOWED HOSTS...