CVE-2012-2374
published 2012-05-23CVE-2012-2374: CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP…
PriorityP423medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
1.36%
69.0th percentile
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-tornado | < python-tornado 2.1.0-3 (bookworm) | python-tornado 2.1.0-3 (bookworm) |
| tornadoweb | tornado | <= 2.2 | — |
| tornadoweb | tornado | — | — |
| tornadoweb | tornado | — | — |
| tornadoweb | tornado | — | — |
| tornadoweb | tornado | — | — |
| tornadoweb | tornado | — | — |
| tornadoweb | tornado | — | — |
| tornadoweb | tornado | — | — |
| tornadoweb | tornado | — | — |
| tornadoweb | tornado | — | — |
| tornadoweb | tornado | >= 0 < 2.2.1 | 2.2.1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2012-2374: python-tornado - CRLF injection vulnerability in the tornado.web.RequestHandler.set_header functi...
vendor_debian·2012·CVSS 5.0
CVE-2012-2374 [MEDIUM] CVE-2012-2374: python-tornado - CRLF injection vulnerability in the tornado.web.RequestHandler.set_header functi...
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
Scope: local
bookworm: resolved (fixed in 2.1.0-3)
bullseye: resolved (fixed in 2.1.0-3)
forky: resolved (fixed in 2.1.0-3)
sid: resolved (fixed in 2.1.0-3)
trixie: resolved (fixed in 2.1.0-3)
OSV
Tornado CRLF injection vulnerability
osv·2022-05-17
CVE-2012-2374 [HIGH] Tornado CRLF injection vulnerability
Tornado CRLF injection vulnerability
CRLF injection vulnerability in the `tornado.web.RequestHandler.set_header` function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
GHSA
Tornado CRLF injection vulnerability
ghsa·2022-05-17
CVE-2012-2374 [HIGH] CWE-20 Tornado CRLF injection vulnerability
Tornado CRLF injection vulnerability
CRLF injection vulnerability in the `tornado.web.RequestHandler.set_header` function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
OSV
CVE-2012-2374: CRLF injection vulnerability in the tornado
osv·2012-05-23·CVSS 5.0
CVE-2012-2374 [MEDIUM] CVE-2012-2374: CRLF injection vulnerability in the tornado
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
No detection rules found.
No public exploits indexed.
http://openwall.com/lists/oss-security/2012/05/18/12http://secunia.com/advisories/49185http://www.openwall.com/lists/oss-security/2012/05/18/6http://www.securityfocus.com/bid/53612http://www.tornadoweb.org/documentation/releases/v2.2.1.htmlhttp://openwall.com/lists/oss-security/2012/05/18/12http://secunia.com/advisories/49185http://www.openwall.com/lists/oss-security/2012/05/18/6http://www.securityfocus.com/bid/53612http://www.tornadoweb.org/documentation/releases/v2.2.1.html
2012-05-23
Published