CVE-2023-27522

Advisory

Affected versions of Uwsgi are vulnerable to HTTP Response splitting. An attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Released 20240601

Maintenance release

Changes
-------

- apache2/mod_proxy_uwsgi: let httpd handle CL/TE for non-http handlers CVE-2024-24795 (Eric Covener)
- remove race-condition over termination of uWSGI process when using need-app and lazy-apps (Hanan .T)
- fix 32-bit compilation with GCC14 (Rosen Penev)
- uwsgiconfig: get compiler version with -dumpfullversion (Riccardo Magliocchetti)
- Fix uwsgi_regexp_match() with pcre2 (Alexandre Rossi)


Availability
------------

You can download uWSGI 2.0.26 from https://files.pythonhosted.org/packages/3a/7a/4c910bdc9d32640ba89f8d1dc256872c2b5e64830759f7dc346815f5b3b1/uwsgi-2.0.26.tar.gz

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24795
• https://github.com/unbit/uwsgi/commit/2abdd3df894d41edc512500bfc5b77650fee7d13
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27522