PT-2023-11359 · Unknown · Onshift Turbogears

Published 2023-02-04 · Updated 2024-05-17 · CVE-2019-25101

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OnShift TurboGears version 1.0.11.10

Description A critical vulnerability has been found in OnShift TurboGears, affecting an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting, and it is possible to initiate the attack remotely.

Recommendations For OnShift TurboGears version 1.0.11.10, upgrade to version 1.0.11.11 to address this issue. As a temporary workaround, consider restricting access to the HTTP Header Handler component until the patch is applied.

Fix

Weakness Enumeration

CWE-436

CWE-113

Related Identifiers

CVE-2019-25101

GHSA-8Q38-W56M-QQ2C

Affected Products

Onshift Turbogears

References · 12

• https://github.com/OnShift/turbogears/releases/tag/v1.0.11.11 · Patch
• https://github.com/OnShift/turbogears/pull/18 · Patch
• https://github.com/OnShift/turbogears/commit/f68bbaba47f4474e1da553aa51564a73e1d92a84 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-25101 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25101 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8q38-w56m-qq2c · Vendor Advisory
• https://github.com/OnShift/turbogears · Note
• https://vuldb.com/?id.220059 · Note
• https://t.me/cvenotify/43647 · Telegram Post
• https://vuldb.com/?ctiid.220059 · Note
• https://t.me/cibsecurity/57520 · Telegram Post
• https://t.me/cvenotify/59824 · Telegram Post