En bref
- CVE-2012-2374 est une vulnérabilité MOYENNE (CVSS 5.0) touchant tornado, tornado (tornadoweb).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.4%, plus élevée que 71.7% des vulnérabilités.
- Correctif : mettre à jour vers 2.2.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| tornado PyPI | < 2.2.1
| 2.2.1
|
| tornado | = 1.0= 1.0.1= 1.1= 1.1.1= 1.2= 1.2.1= 2.0= 2.1= 2.1.1≤ 2.2
| No fix yet |
Description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
NVD description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free