Em resumo
- CVE-2012-2374 é uma vulnerabilidade MÉDIO (CVSS 5.0) que afeta tornado, tornado (tornadoweb).
- Chance de exploração nos próximos 30 dias (EPSS): 1.4%, maior que 71.7% das vulnerabilidades.
- Correção: atualize para 2.2.1 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| tornado PyPI | < 2.2.1
| 2.2.1
|
| tornado | = 1.0= 1.0.1= 1.1= 1.1.1= 1.2= 1.2.1= 2.0= 2.1= 2.1.1≤ 2.2
| No fix yet |
Description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
NVD description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free