Description

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

Remediation

References

CVE-2024-58384

Related Vulnerabilities

MySQL CVE-2012-0118 Vulnerability (CVE-2012-0118)

WordPress Plugin Sermon Browser Multiple Cross-Site Scripting Vulnerabilities (0.45.15)

Apache Traffic Server Improper Input Validation Vulnerability (CVE-2017-5660)

Restlet Framework Improper Restriction of XML External Entity Reference Vulnerability (CVE-2017-14868)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-4064)

Severity

Medium

Classification

CVE-2024-58384 CWE-707 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities