PT-2020-10966

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager version 9.0.7 IBM Security Verify Access version 10.0.0 Description The issue allows a remote attacker to perform HTTP response splitting attacks by using a specially-crafted URL. Once the URL is clicked, the server...

Security Bulletin: Security vulnerabilities have been fixed in the IBM Security Access Manager and IBM Security Verify Access products

Summary Fixes for security vulnerabilities identified in IBM Security Access Manager and IBM Security Verify Access are available. Vulnerability Details CVEID: CVE-2020-11868 DESCRIPTION: NTP is vulnerable to a denial of service, caused by a flaw in ntpd. By sending a server mode packet with a...

EulerOS 2.0 SP3 : ruby (EulerOS-SA-2020-2139)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause...

HTTP Response Splitting in Puma

...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect Rational Software Architect and Rational Software Architect for WebSphere Software

Summary OpenSSL vulnerabilities were disclosed on January 28, 2016 and again on March 01, 2016 by the OpenSSL Project. OpenSSL is used by Rational Software Architect and Rational Software Architect for WebSphere Software. The applicable CVEs have been addressed. Vulnerability Details CVEID:...

Amazon Linux AMI : ruby24 (ALAS-2020-1422)

The version of ruby24 installed on the remote host is prior to 2.4.10-2.12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1422 advisory. Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using...

Important: ruby24

Issue Overview: Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to...

HTTP Response Splitting

undertow is vulnerable to HTTP response splitting. The vulnerability exists as in EAP, the field-name is not parsed in accordance to RFC7230...

GHSA-F97H-2PFX-F59F HTTP response splitting in uvicorn

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP...

HTTP response splitting in uvicorn

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP...

CRLF Injection

uvicorn is vulnerable to CRLF injection. An attacker is able to inject carriage return and line feed characters into an HTTP response and perform HTTP response splitting attacks...

CVE-2020-7695

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers...

CVE-2020-7695

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers...

DEBIAN-CVE-2020-7695

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers...

Design/Logic Flaw

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers...

CVE-2020-7695

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers...

PYSEC-2020-151

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers...

PYSEC-2020-151

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers...

UBUNTU-CVE-2020-7695

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers...

CVE-2020-7695

CVE-2020-7695 affects Uvicorn before 0.11.7. The issue is an HTTP response splitting vulnerability where CRLF sequences are not escaped in header values, allowing an attacker to inject arbitrary headers or even craft an arbitrary response body when input is used to build HTTP headers. The availab...