medium6.1
CVE-2020-7655
HTTP Request Smuggling in netius
Impact
netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | netius | < 1.17.58 | 1.17.58 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hive | Netius | before 1.17.58 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://snyk.io/vuln/SNYK-PYTHON-NETIUS-569141
- https://github.com/advisories/GHSA-wm2m-xrrp-j74c
- https://nvd.nist.gov/vuln/detail/CVE-2020-7655
- https://github.com/hivesolutions/netius/commit/9830881ef68328f8ea9c7901db1d11690677e7d1
- https://github.com/pypa/advisory-database/tree/main/vulns/netius/PYSEC-2020-242.yaml