[Python-modules-team] Bug#969275: python-uvicorn: CVE-2020-7695

[Salvatore Bonaccorso]

Source: python-uvicorn
Version: 0.11.5-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1  0.11.3-1

Hi,

The following vulnerability was published for python-uvicorn.

CVE-2020-7695[0]:
| Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF
| sequences are not escaped in the value of HTTP headers. Attackers can
| exploit this to add arbitrary headers to HTTP responses, or even
| return an arbitrary response body, whenever crafted input is used to
| construct HTTP headers.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-7695
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7695
[1] https://snyk.io/vuln/SNYK-PYTHON-UVICORN-570471
[2] https://github.com/encode/uvicorn/issues/719

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore