PYSEC-2012-5

At a glance

Published: 2012-05-23 20:55 UTC
Updated: 2026-06-10 17:02 UTC
CVE: CVE-2012-2374
Aliases: GHSA-f7fv-v9rh-prvc

Description

CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.

Affected packages

Package	Versions
PyPI · tornado	introduced 0, fixed 2.2.1

References

http://www.tornadoweb.org/documentation/releases/v2.2.1.html WEB
http://openwall.com/lists/oss-security/2012/05/18/12 WEB
http://secunia.com/advisories/49185 ADVISORY
http://www.securityfocus.com/bid/53612 WEB
http://www.openwall.com/lists/oss-security/2012/05/18/6 WEB
https://github.com/advisories/GHSA-f7fv-v9rh-prvc ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database