PT-2022-5090 · Pallets+1 · Werkzeug+1

Acipmo · Published 2022-02-17 · Updated 2025-04-11 · CVE-2022-29361

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pallets Werkzeug versions 2.1.0 and below

Description The issue is related to improper parsing of HTTP requests, which can allow an attacker to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. This can occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project. The vendor's position is that this behavior is only possible under specific conditions.

Recommendations For versions 2.1.0 and below, consider disabling development mode and using an HTTP server within the Werkzeug project to minimize the risk of exploitation. Restrict access to the HTTP request parsing functionality until a patch is available. Avoid using crafted HTTP requests with multiple requests included inside the body in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALT-PU-2022-2662

ALT-PU-2025-3304

BDU:2022-06319

CVE-2022-29361

OPENSUSE-SU-2024:13098-1

PYSEC-2022-203

Affected Products

Alt Linux

Werkzeug

References · 19

• https://github.com/pallets/werkzeug/commit/9a3a981d70d2e9ec3344b5192f86fcaf3210cd85 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29361 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29361 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06319 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13098-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-29361 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-203 · Vendor Advisory
• https://github.com/pallets/werkzeug/issues/2420 · Note
• https://suse.com/security/cve/CVE-2022-29361 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/227307 · Note
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://t.me/cvenotify/31247 · Telegram Post
• https://security.alpinelinux.org/vuln/CVE-2022-29361 · Note
• https://t.me/cibsecurity/43314 · Telegram Post
• https://ibm.com/support/pages/node/6619975 · Note