Bugzilla – Bug 1215469
VUL-0: CVE-2023-41419: python-gevent: http request smuggling
Last modified: 2024-06-05 07:54:10 UTC
CVE-2023-41419 https://github.com/gevent/gevent/commit/693181e8e109f1a91d1783cb06c758329553fc72 - Make ``gevent.pywsgi`` comply more closely with the HTTP specification for chunked transfer encoding. In particular, we are much stricter about trailers, and trailers that are invalid (too long or featuring disallowed characters) forcibly close the connection to the client *after* the results have been sent. Trailers otherwise continue to be ignored and are not available to the WSGI application. Previously, carefully crafted invalid trailers in chunked requests on keep-alive connections might appear as two requests to ``gevent.pywsgi``. Because this was handled exactly as a normal keep-alive connection with two requests, the WSGI application should handle it normally. However, if you were counting on some upstream server to filter incoming requests based on paths or header fields, and the upstream server simply passed trailers through without validating them, then this embedded second request would bypass those checks. (If the upstream server validated that the trailers meet the HTTP specification, this could not occur, because characters that are required in an HTTP request, like a space, are not allowed in trailers.) CVE-2023-41419 was reserved for this. Our thanks to the original reporters, Keran Mu (mkr22@mails.tsinghua.edu.cn) and Jianjun Chen (jianjun@tsinghua.edu.cn), from Tsinghua University and Zhongguancun Laboratory. See :issue:`1989`.
Upstream seems to be https://github.com/gevent/gevent/issues/1989
So, are these affected channels? SUSE:ALP:Source:Standard:1.0 SUSE:SLE-12-SP3:Update:Products:Cloud8:Update SUSE:SLE-12-SP4:Update:Products:Cloud9:Update SUSE:SLE-15:Update
as far as I see yes.
https://build.suse.de/request/show/308924
SUSE-SU-2023:3975-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1215469 CVE References: CVE-2023-41419 Sources used: SUSE OpenStack Cloud 9 (src): python-gevent-1.3.5-3.3.1 SUSE OpenStack Cloud Crowbar 9 (src): python-gevent-1.3.5-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4009-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1215469 CVE References: CVE-2023-41419 Sources used: SUSE OpenStack Cloud 8 (src): python-gevent-1.1.2-3.3.1 SUSE OpenStack Cloud Crowbar 8 (src): python-gevent-1.1.2-3.3.1 HPE Helion OpenStack 8 (src): python-gevent-1.1.2-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4091-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1215469 CVE References: CVE-2023-41419 Sources used: SUSE Manager Server 4.2 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Enterprise Storage 7.1 (src): python-gevent-1.2.2-150000.5.3.1 SUSE CaaS Platform 4.0 (src): python-gevent-1.2.2-150000.5.3.1 Basesystem Module 15-SP4 (src): python-gevent-1.2.2-150000.5.3.1 Basesystem Module 15-SP5 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Manager Proxy 4.2 (src): python-gevent-1.2.2-150000.5.3.1 SUSE Manager Retail Branch Server 4.2 (src): python-gevent-1.2.2-150000.5.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done, closing