In breve
- CVE-2012-2374 è una vulnerabilità MEDIO (CVSS 5.0) che riguarda tornado, tornado (tornadoweb).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.4%, superiore al 71.7% delle vulnerabilità.
- Correzione: aggiornare a 2.2.1 o successiva.
| Package | Affected versions | Patched versions |
|---|
| tornado PyPI | < 2.2.1
| 2.2.1
|
| tornado | = 1.0= 1.0.1= 1.1= 1.1.1= 1.2= 1.2.1= 2.0= 2.1= 2.1.1≤ 2.2
| No fix yet |
Description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
NVD description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free