En resumen
- CVE-2012-2374 es una vulnerabilidad MEDIO (CVSS 5.0) que afecta a tornado, tornado (tornadoweb).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 71.7% de las vulnerabilidades.
- Solución: actualizar a 2.2.1 o posterior.
| Package | Affected versions | Patched versions |
|---|
| tornado PyPI | < 2.2.1
| 2.2.1
|
| tornado | = 1.0= 1.0.1= 1.1= 1.1.1= 1.2= 1.2.1= 2.0= 2.1= 2.1.1≤ 2.2
| No fix yet |
Description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
NVD description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free