Kurz gesagt
- CVE-2012-2374 ist eine Schwachstelle (MITTEL (CVSS 5.0)) in tornado, tornado (tornadoweb).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.4%, höher als bei 71.7% aller Schwachstellen.
- Abhilfe: auf 2.2.1 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| tornado PyPI | < 2.2.1
| 2.2.1
|
| tornado | = 1.0= 1.0.1= 1.1= 1.1.1= 1.2= 1.2.1= 2.0= 2.1= 2.1.1≤ 2.2
| No fix yet |
Description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
NVD description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free