Skip to content
OpenAdvisories
High USN-5551-1 1 CVE

mod-wsgi vulnerability

Published Aug 4, 2022 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that mod-wsgi did not correctly remove the X-Client-IP
header when processing requests from untrusted proxies. A remote attacker
could use this issue to pass the header to WSGI applications, contrary
to expectations.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS mod-wsgi 4.5.17-1ubuntu1.1
Ubuntu · 20.04 LTS 20.04:LTS mod-wsgi 4.6.8-1ubuntu3.1
Ubuntu · 22.04 LTS 22.04:LTS mod-wsgi 4.9.0-1ubuntu0.1

Vulnerabilities 1

  • High 7.5
    CVE-2022-2255

    Incorrect header handling in mod-wsgi

    A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.

    mod-wsgi mod-wsgi mod_wsgi mod-wsgi Debian Ubuntu Azure Linux PyPI

References

  • report
    https://ubuntu.com/security/CVE-2022-2255