-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows the vulnerability was addressed by adding CR/LF validation to the redirect() function in controllers.py. The patch introduces a check for \r and \n characters in the redirect_path parameter and throws InvalidRedirectException if found. This directly corresponds to CWE-113 (HTTP Response Splitting) described in the advisory. The vulnerability manifest in redirects aligns with the component 'HTTP Header Handler' mentioned in the CVE, and the test case added in test_controllers.py confirms the exploit scenario involved redirects with injected newlines.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| TurboGears | pip | < 1.0.11.11 | 1.0.11.11 |