Skip to content

Commit

Permalink
Add Gunicorn exploit notification
Browse files Browse the repository at this point in the history
  • Loading branch information
vasudev-gm committed May 1, 2024
1 parent 404e716 commit 8d26928
Show file tree
Hide file tree
Showing 4 changed files with 32 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ Hello fellow readers, the objective of the article will be to reduce high batter

> ## Background
If you've heard the phone is being re-indexing or optimizing the apps and media in the background causing worse battery drain and thermals until the process is completed. The actual problem stems from a better user experience approach introduced in Android 7 or later which makes it optional to optimize the apps to reduce the installation time and enable quick startup.
If you had lower power devices from Samsung, Redmi etc you will notice it was a welcome change to quicken the patching process and minimize the time we pray to God it won\'t get stuck at **Updating Progress Screen**.
If you had lower power devices from Samsung, Redmi etc you will notice it was a welcome change to quicken the patching process and minimize the time we pray to God it won\'t get stuck at **Updating Progress Screen**. <!-- more -->
So ergo, with latest android version the optimizer logic works when one of the following conditions are met or satisfied:
1. The phone is connected to the charger,

Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
---
title: Patch Gunicorn to version 22.0 to prevent HTTP Request Smuggling vulnerability
date: 2024-05-01 23:03:37
tags:
- gunicorn
- request smuggling exploit
- github advisory
- CVE-2024-1135
- huntr
- nist

---
## Which version(s) are affected?
Hey fellow readers, if you're deploying your python application or containerized application through Gunicorn (Green Unicorn) there is a new vulnerability that bypasses validation when == multiple conflicting Transfer-Encoding headers == are used which are treated as chunked data regardlesss of final encoding leading to Request Smuggling allowing access to restricted API endpoints in your application without needed credentials/tokens.
<!-- more -->

The new update version 22.0 fixes the issue mentioned in the [commit](https://github.com/benoitc/gunicorn/commit/ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d).

The PoC for the exploit can be found here at [Huntr](https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1).

In short, versions < 22.0 are affected. You can update it manually to the fixed version via pip or pipenv or conda. If they are unable to update the package, the best way would be to secure the endpoints via firewall and block access.

## Source(s)
- [Github Advisory](https://github.com/advisories/GHSA-w3h3-4rj7-4ph4)
- [NIST Advisory](https://nvd.nist.gov/vuln/detail/CVE-2024-1135)
- [Huntr Advisory](https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1)
- [Gunicorn Commit](benoitc/gunicorn@ac29c9b)
- [Gunicorn Releases](https://github.com/benoitc/gunicorn/releases/tag/22.0.0)
2 changes: 1 addition & 1 deletion source/_posts/Slow-Write-Speed-Fix-on-WD-SN570.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ tags:
- steam
- epic
---
Hello fellow readers, in this article I will be providing a fix for Slow Write Speed issues on WD SN570 when using Steam/Epic Downloads and media transfers.
Hello fellow readers, in this article I will be providing a fix for Slow Write Speed issues on WD SN570 when using Steam/Epic Downloads and media transfers.<!-- more -->

## Background <br>
The advent of Host Memory Buffer on budget NVMe drives to give better write performance instead of adding DRAM on the drive. With HMB, SSD manufacturers can save on BOM costs and make the drive more compact to focus on higher storage size. As you are aware, most NVMe SSDs are available in [M.2](https://en.wikipedia.org/wiki/M.2) format with different sizes aka lengths i.e 30mm, 42mm and 80mm. There are few sizes used in enterprise SSDs optimized for more write endurance such as 60mm and 110mm.
Expand Down
4 changes: 2 additions & 2 deletions source/_posts/intel-CPU-stability-woes.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ tags:

### Initial Reports
Couple of weeks ago, many Intel 13<sup>th</sup> and 14<sup>th</sup> Generation CPUs especially their unlocked series i.e. K, KF & KS series reported [performance and stability issues in NVIDIA forums](https://www.nvidia.com/en-us/geforce/forums/game-ready-drivers/13/542018/performance-issues-and-stability-problems-with-nvi/#!%2Ffollowing) that few games and game development engines such as Epic's Unreal Engine 5.
There are several reports from lot of users from [Intel Community Forums](https://community.intel.com/t5/Processors/Regarding-Reports-of-13th-14th-Gen-Unlocked-Desktop-Users/td-p/1575863?profile.language=en), News Outlets such as [TechPowerUp](https://www.techpowerup.com/321461/nvidia-points-intel-raptor-lake-cpu-users-to-get-help-from-intel-amid-system-instability-issues),[PC GamesN](https://www.pcgamesn.com/nvidia/gpu-intel-raptor-lake-issues),[Ars Technica](https://arstechnica.com/gadgets/2024/04/intel-is-investigating-game-crashes-on-top-end-core-i9-desktop-cpus/),[OC.Net](https://www.overclock.net/threads/official-asus-strix-maximus-z790-owners-thread.1800191/page-853#post-29323821) etc.

There are several reports from lot of users from [Intel Community Forums](https://community.intel.com/t5/Processors/Regarding-Reports-of-13th-14th-Gen-Unlocked-Desktop-Users/td-p/1575863?profile.language=en), News Outlets such as [TechPowerUp](https://www.techpowerup.com/321461/nvidia-points-intel-raptor-lake-cpu-users-to-get-help-from-intel-amid-system-instability-issues), [PC GamesN](https://www.pcgamesn.com/nvidia/gpu-intel-raptor-lake-issues), [Ars Technica](https://arstechnica.com/gadgets/2024/04/intel-is-investigating-game-crashes-on-top-end-core-i9-desktop-cpus/), [OC.Net](https://www.overclock.net/threads/official-asus-strix-maximus-z790-owners-thread.1800191/page-853#post-29323821) etc.
<!-- more -->

### What is the fix officially or unofficially?

Expand Down

0 comments on commit 8d26928

Please sign in to comment.