Skip to content

Upgrading gunicorn 21 to 22

Safe21.2.0 → 22.0.0Security2Other2

Full comparisonBack to gunicorn
SafeUpgrade verdict

2 security fixes. Nothing to change in your code.

In plain terms
  • Request smuggling leading to endpoint restriction bypass in Gunicorn
  • Gunicorn HTTP Request/Response Smuggling vulnerability
Must act 2 items need code or config changes

Python requirement changed in 22.0.0: >=3.5 → >=3.7.

What you must change

Security2
Request smuggling leading to endpoint restriction bypass in Gunicorn
High · CVSS 8.2
22.0.0GitHub AdvisoryOriginalView source
Gunicorn HTTP Request/Response Smuggling vulnerability
High · CVSS 7.5
22.0.0GitHub AdvisoryOriginalView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • changed: function run() → function run(prog=…)
  • added: class CasefoldHTTPMethod(Setting)
  • added: class HeaderMap(Setting)
  • added: class PermitUnconventionalHTTPMethod(Setting)
  • added: class PermitUnconventionalHTTPVersion(Setting)
  • added: class TolerateDangerousFraming(Setting)
  • added: field CasefoldHTTPMethod.action
  • added: field CasefoldHTTPMethod.cli
  • added: field CasefoldHTTPMethod.default
  • added: field CasefoldHTTPMethod.desc
  • added: field CasefoldHTTPMethod.name
  • added: field CasefoldHTTPMethod.section
  • added: field CasefoldHTTPMethod.validator
  • added: field HeaderMap.cli
  • added: field HeaderMap.default
  • added: field HeaderMap.desc
  • added: field HeaderMap.name
  • added: field HeaderMap.section
  • added: field HeaderMap.validator
  • added: field PermitUnconventionalHTTPMethod.action
  • added: field PermitUnconventionalHTTPMethod.cli
  • added: field PermitUnconventionalHTTPMethod.default
  • added: field PermitUnconventionalHTTPMethod.desc
  • added: field PermitUnconventionalHTTPMethod.name
  • added: field PermitUnconventionalHTTPMethod.section
  • added: field PermitUnconventionalHTTPMethod.validator
  • added: field PermitUnconventionalHTTPVersion.action
  • added: field PermitUnconventionalHTTPVersion.cli
  • added: field PermitUnconventionalHTTPVersion.default
  • added: field PermitUnconventionalHTTPVersion.desc
  • added: field PermitUnconventionalHTTPVersion.name
  • added: field PermitUnconventionalHTTPVersion.section
  • added: field PermitUnconventionalHTTPVersion.validator
  • added: field TolerateDangerousFraming.action
  • added: field TolerateDangerousFraming.cli
  • added: field TolerateDangerousFraming.default
  • added: field TolerateDangerousFraming.desc
  • added: field TolerateDangerousFraming.name
  • added: field TolerateDangerousFraming.section
  • added: field TolerateDangerousFraming.validator
  • added: function validate_header_map_behaviour(val)
  • added: class ConfigurationProblem(ParseException)
  • added: class UnsupportedTransferCoding(ParseException)
  • added: constructor ConfigurationProblem(info)
  • added: constructor UnsupportedTransferCoding(hdr)
  • removed: variable HEADER_RE
  • removed: variable METH_RE
  • changed: method Message.parse_headers(data) → method Message.parse_headers(data, from_trailer=…)
  • added: method Message.force_close()
  • added: variable METHOD_BADCHAR_RE
  • added: variable RFC9110_5_6_2_TOKEN_SPECIALS
  • added: variable TOKEN_RE