CVE-2019-7313

Name of the Vulnerable Software and Affected Versions Buildbot versions prior to 1.8.1

Description The issue allows CRLF injection in the Location header of "/auth/login" and "/auth/logout" API endpoints via the redirect parameter. This affects other web sites in the same domain.

Recommendations For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /auth/login and /auth/logout API endpoints to minimize the risk of exploitation. Avoid using the redirect parameter in these endpoints until the issue is resolved.