{"action":"Upgrade gunicorn to 19.5.0 or later.","affected":[{"fixed":"19.5.0","introduced":"0"}],"component":"gunicorn","cve_ids":["CVE-2018-1000164"],"ecosystem":"PyPI","epss":0.02369,"exploited":false,"fixed_versions":["19.5.0"],"ghsa_id":"GHSA-32pc-xphx-q4f6","id":"tcs_01M5KG823JANZDM6MJ1NQRYJ1Z","modified_at":"2023-11-08T03:59:36.379813Z","published_at":"2018-04-18T19:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-55","https://github.com/benoitc/gunicorn/issues/1227","https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5","https://lists.debian.org/debian-lts-announce/2018/04/msg00022.html","https://www.debian.org/security/2018/dsa-4186","https://usn.ubuntu.com/4022-1/","https://github.com/advisories/GHSA-32pc-xphx-q4f6"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2018-55","url":"https://osv.dev/vulnerability/PYSEC-2018-55"},{"source":"nvd","source_id":"CVE-2018-1000164","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000164"}],"summary":"gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in \"process_headers\" function in \"gunicorn/http/wsgi.py\" that can result in an attac"}