HTTP Response Splitting Affecting werkzeug package, versions [,0.8)
Snyk CVSS
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-WERKZEUG-40739
- published 4 Dec 2017
- disclosed 25 Sep 2011
- credit Unknown
How to fix?
Upgrade werkzeug to version 0.8 or higher.
Overview
Affected versions of werkzeug are vulnerable to HTTP Response Splitting.
It allows newline characters in values in the header. An attacker can leverage this to inject arbitrary headers and conduct HTTP response splitting attacks.