CVE-2024-1135

Name	CVE-2024-1135
Description	Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3851-1, DLA-3996-1, ELA-1117-1
Debian Bugs	1069126

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gunicorn (PTS)	jessie, jessie (lts)	19.0-1+deb8u1	vulnerable
	stretch (lts), stretch	19.6.0-10+deb9u3	fixed
	buster (security), buster, buster (lts)	19.9.0-1+deb10u1	fixed
	bullseye	20.1.0-1	vulnerable
	bullseye (security)	20.1.0-1+deb11u1	fixed
	bookworm	20.1.0-6	vulnerable
	sid, trixie	23.0.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gunicorn	source	jessie	(unfixed)	end-of-life
gunicorn	source	stretch	19.6.0-10+deb9u3		ELA-1117-1
gunicorn	source	buster	19.9.0-1+deb10u1		DLA-3851-1
gunicorn	source	bullseye	20.1.0-1+deb11u1		DLA-3996-1
gunicorn	source	(unstable)	22.0.0-1			1069126

Notes

[bookworm] - gunicorn <no-dsa> (Minor issue)
[buster] - gunicorn <postponed> (Minor issue)
https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
https://github.com/benoitc/gunicorn/commit/ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d