Summary
It was discovered that the gevent WSGI server incorrectly validated chunked
transfer encoding trailers in HTTP requests. A remote attacker could
possibly use this issue to perform HTTP request smuggling attacks, leading
to privilege escalation.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-gevent | 1.1.0-2ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-gevent | 1.2.2-2ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-gevent | 1.4.0-1.2ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python-gevent | 21.8.0-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Critical 9.8
Gevent allows remote attacker to escalate privileges
An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
References
-
report
https://ubuntu.com/security/CVE-2023-41419