HTTP Request Smuggling due to improper validation of Transfer-Encoding headers
CVE: CVE-2024-1135
Component: python-gunicorn
CWE: CWE-444
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2024-04-15T00:00:00+00:00

An HTTP Request Smuggling vulnerability was found in Gunicorn. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks, including cache poisoning, session manipulation, and data exposure.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all applications using Jinja2 must be restarted.
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For detailed instructions on how to apply this update, see:
https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/4/html/migrating_red_hat_update_infrastructure/assembly_upgrading-red-hat-update-infrastructure_migrating-red-hat-update-infrastructure

For other information, see the product documentation:
https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/4
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:8908e5a46f106e7520faa5f5ee679033c4c2f0026f1b8a339e6b3ea4becdd969

      (For s390x architecture)
      The image digest is sha256:c591525140e99a733a71ec09db2688168a50537385639ac2786c0fcf5af80203

      (For ppc64le architecture)
      The image digest is sha256:e8a52b12867a6ec15cf9153b4c9f4bf3e1ab7626c35cd7854c8bc145d9b2a9fd

      (For aarch64 architecture)
      The image digest is sha256:b3149ccbc7979c497fc972f2b0f56ba9e954baa9b0e0881d283c6facb176d46a

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:dcf5c3ad7384f8bee3c275da8f886b0bc9aea7611d166d695d0cf0fff40a0b55

      (For s390x architecture)
      The image digest is sha256:fbe90883f2a74685b91cfe94521084a1d18682e0f9d06bd509693557d31e4772

      (For ppc64le architecture)
      The image digest is sha256:6e6efacfb8366ee4cc0adcaac0e1cf6b041f2d343438732f1a76d19158435cde

      (For aarch64 architecture)
      The image digest is sha256:68a3d7b07722692b591d33e4e8377339c519ea875113dd1ced489dd67e199eaf

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:4d30b359aa6600a89ed49ce6a9a5fdab54092bcb821a25480fdfbc47e66af9ec

      (For s390x architecture)
      The image digest is sha256:e9c1f125eadb37b95f4f7d33b883bb3b2a2f8fb1fc76ef019d41ce568cc65f32

      (For ppc64le architecture)
      The image digest is sha256:8ba7ba6c183719007a4d5f8fc221eace8ce3c5d0042b231c49be25a41656aacc

      (For aarch64 architecture)
      The image digest is sha256:0fed37d60b1d0e28cb3960e1cd53a8ce1c6d1d51abf48d78dac6751a56ec5ed3

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:bb1182cd9001d6811dea8c5823235c17b9a316cce3bb13c51325250c14b46787

      (For s390x architecture)
      The image digest is sha256:406246b2588868ce440434d1b3a4deed88c22085612eb1bf7b8faddc5a37d02a

      (For ppc64le architecture)
      The image digest is sha256:277ef1089fd5495f728676929a365f6e2cf6bd739855964e27b61e74377f1119

      (For aarch64 architecture)
      The image digest is sha256:092ed599a300fb7985b94a5d9f108848d0ef0008399068e1cd207ea9e948d6d5

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.