GHSA-78cg-ph9m-rjjx: 
Python Análise e mitigação de vulnerabilidades

Impact

Several gunicorn_h1c APIs could crash the interpreter or read memory they no longer owned:

• H1CProtocol published the parsed headers before it had filled and validated them, and ran callbacks while holding pointers into its buffer. Reading headers from a callback or after a rejected request, calling reset() from a callback, or changing the list returned by headers crashed the process.
• parse_request, parse_request_fast, parse_request_raw, parse_response and parse_headers used last_len as an offset into the data without checking it, so an out-of-range value read outside the buffer.
• parse_request, parse_response, parse_headers, parse_to_wsgi_environ and parse_to_asgi_scope released the input buffer and then copied fields out of it, a use after free when the exporter frees that memory on release.
• parse_to_wsgi_environ mapped X-Auth-User and X_Auth_User to the same HTTP_X_AUTH_USER key and joined their values, so a client could add to a header set by a proxy. gunicorn itself does not use these APIs in a way that triggers them; applications and libraries that call them directly are affected.

Patches

Fixed in 0.6.10. H1CProtocol validates and builds the request before publishing it or running callbacks, and re-entering it from a callback raises RuntimeError; last_len outside 0..len(data) raises ValueError; the input buffer is kept until the result is built; parse_to_wsgi_environ drops header names containing _, like gunicorn's default header_map = "drop".

Workarounds

Do not call reset(), feed() or finish() from H1CProtocol callbacks, do not modify the list returned by headers, pass last_len only as returned by a previous call, pass bytes objects to the parse functions, and drop header names containing _ before using parse_to_wsgi_environ.