—

PYSEC-2015-13

Quick fix

PYSEC-2015-13 — kallithea: upgrade to the fixed version with the command below.

pip install --upgrade 'kallithea>=0.3'

Details

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/kallithea

Introduced in: 0Fixed in: 0.3

Fixpip install --upgrade 'kallithea>=0.3'

References

http://packetstormsecurity.com/files/133897/Kallithea-0.2.9-HTTP-Response-Splitting.html[WEB]
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5267.php[WEB]
https://www.exploit-db.com/exploits/38424/[WEB]
https://kallithea-scm.org/security/cve-2015-5285.html[WEB]
https://github.com/advisories/GHSA-vfg9-phjp-9frw[ADVISORY]