HTTP response splitting vulnerability

[kevindixon]

See https://app.snyk.io/vuln/SNYK-PYTHON-UVICORN-570471

[tomchristie]

Heya, so it looks like this needs to be resolved in httptools, right?

[kevindixon]

@tomchristie if that question is directed at me... honestly I have no idea.
Just a dumb client using the library with no time to dig under the hood... :-)

[snoopysecurity]

Hey @tomchristie, what part of the uvicorn deals with parsing http headers? could be a httptools problem. i believe it would be a case of adding some extra validation to check for %0d(CR),%0a(LF) characters. Maybe the below commits from similar issues would help

• CVE-2018-1000164

• https://snyk.io/vuln/SNYK-PYTHON-WAITRESS-564339

[tomchristie]

Yup first step is double checking if it's directly in httptools that this needs addressing. (Looks like it but I've not dived into it.)

Really this ought to be getting dealt with privatly, but that's my bad, Snyk did notify me about this via email, but I've been too over-committed with everything to have dug into it yet.