[Python-modules-team] Bug#969276: python-uvicorn: CVE-2020-7694

[Salvatore Bonaccorso]

Source: python-uvicorn
Version: 0.11.5-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/encode/uvicorn/issues/723
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 0.11.3-1

Hi,

The following vulnerability was published for python-uvicorn.

CVE-2020-7694[0]:
| This affects all versions of package uvicorn. The request logger
| provided by the package is vulnerable to ASNI escape sequence
| injection. Whenever any HTTP request is received, the default
| behaviour of uvicorn is to log its details to either the console or a
| log file. When attackers request crafted URLs with percent-encoded
| escape sequences, the logging component will log the URL after it's
| been processed with urllib.parse.unquote, therefore converting any
| percent-encoded characters into their single-character equivalent,
| which can have special meaning in terminal emulators. By requesting
| URLs with crafted paths, attackers can: * Pollute uvicorn's access
| logs, therefore jeopardising the integrity of such files. * Use ANSI
| sequence codes to attempt to interact with the terminal emulator
| that's displaying the logs (either in real time or from a file).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-7694
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7694
[1] https://snyk.io/vuln/SNYK-PYTHON-UVICORN-575560
[2] https://github.com/encode/uvicorn/issues/723

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore