{"action":"Upgrade buildbot to 1.8.1 or later.","affected":[{"fixed":"1.8.1","introduced":"0.9.0"}],"component":"buildbot","cve_ids":["CVE-2019-7313"],"ecosystem":"PyPI","epss":0.0087,"exploited":false,"fixed_versions":["1.8.1"],"ghsa_id":"GHSA-66x7-2r56-fj77","id":"tcs_01M5KG98NNA2KK409VB3YQNHGE","modified_at":"2026-06-10T17:00:39.466724525Z","published_at":"2019-02-03T08:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-7","https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code","https://github.com/advisories/GHSA-66x7-2r56-fj77"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-7","url":"https://osv.dev/vulnerability/PYSEC-2019-7"}],"summary":"www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain."}