Uvicorn 0.11.3 is vulnerable to CVE-2020-7695 and CVE-2020-7694

[Welton Rodrigo Torres Nascimento]

Uvicorn on docker image tiangolo/uvicorn-gunicorn-fastapi:python3.8 is uvicorn 0.11.3 with CPython 3.8.2 on Linux

This version is affected by two CVES: CVE-2020-7695 and CVE-2020-7694

Output of pipenv check on this image:

Checking PEP 508 requirements...  Passed!  Checking installed package
safety...  38664: uvicorn <0.11.7 resolved (0.11.3 installed)!  This
affects all versions of package uvicorn. The request logger provided
by the package is vulnerable to ASNI escape sequence injection.
Whenever any HTTP request is received, the default behaviour of
uvicorn is to log its details to either the console or a log file.
When attackers request crafted URLs with percent-encoded escape
sequences, the logging component will log the URL after it's been
processed with urllib.parse.unquote, therefore converting any
percent-encoded characters into their single-character equivalent,
which can have special meaning in terminal emulators. By requesting
URLs with crafted paths, attackers can: * Pollute uvicorn's access
logs, therefore jeopardising the integrity of such files. * Use
ANSI sequence codes to attempt to interact with the terminal emulator
that's displaying the logs (either in real time or from a file).
See: CVE-2020-7694.

38665: uvicorn <0.11.7 resolved (0.11.3 installed)!  Uvicorn before
0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are
not escaped in the value of HTTP headers. Attackers can exploit
this to add arbitrary headers to HTTP responses, or even return an
arbitrary response body, whenever crafted input is used to construct
HTTP headers. See: CVE-2020-7695.

The solution will be probably to update the upstream images.

[Sebastián Ramírez]

Thanks! I recently upgraded the dependencies and released new versions of the images, also setting up weekly rebuilds and Dependabot to help me keep everything up to date. 🤓

Sorry for the long delay! 🙈 I wanted to personally address each issue/PR and they piled up through time, but now I'm checking each one in order.

[github-actions]

Assuming the original issue was solved, it will be automatically closed now. But feel free to add more comments or create new issues.