TI-2002-01327 Aliases CVE-2002-1405 GHSA-27fc-4jc3-pjvm

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject…

LOW 31Published 2004-09-01 · Updated 2024-08-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Partial · None
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.

Why it matters now

EPSS 0.05039 92nd percentileScored 2026-11-07

Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:a:elinks:elinks:0.2.4:::::::*	0.2.4	Vulnerable	Elinks
cpe:2.3:a:elinks:elinks:0.3.2:::::::*	0.3.2	Vulnerable	Elinks
cpe:2.3:a:links:links:0.96:::::::*	0.96	Vulnerable	Links
cpe:2.3:a:university_of_kansas:lynx:2.8.2_rel1:::::::*	2.8.2_rel1	Vulnerable	University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.3:::::::*	2.8.3	Vulnerable	University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.3_rel1:::::::*	2.8.3_rel1	Vulnerable	University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.4:::::::*	2.8.4	Vulnerable	University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.4_rel1:::::::*	2.8.4_rel1	Vulnerable	University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.5_dev8:::::::*	2.8.5_dev8	Vulnerable	University Of Kansas

cpe:2.3:a:elinks:elinks:0.2.4:*:*:*:*:*:*:* Versions 0.2.4 Vulnerable ·Elinks
cpe:2.3:a:elinks:elinks:0.3.2:*:*:*:*:*:*:* Versions 0.3.2 Vulnerable ·Elinks
cpe:2.3:a:links:links:0.96:*:*:*:*:*:*:* Versions 0.96 Vulnerable ·Links
cpe:2.3:a:university_of_kansas:lynx:2.8.2_rel1:*:*:*:*:*:*:* Versions 2.8.2_rel1 Vulnerable ·University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.3:*:*:*:*:*:*:* Versions 2.8.3 Vulnerable ·University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.3_rel1:*:*:*:*:*:*:* Versions 2.8.3_rel1 Vulnerable ·University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.4:*:*:*:*:*:*:* Versions 2.8.4 Vulnerable ·University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.4_rel1:*:*:*:*:*:*:* Versions 2.8.4_rel1 Vulnerable ·University Of Kansas
cpe:2.3:a:university_of_kansas:lynx:2.8.5_dev8:*:*:*:*:*:*:* Versions 2.8.5_dev8 Vulnerable ·University Of Kansas

Remediation

Red Hat 2 advisories

RHSA-2003:030 Released 2003-02-21 · Red Hat rating Low
lynx security update
- Red Hat Enterprise Linux AS (Advanced Server) version 2.1
- Red Hat Linux Advanced Workstation 2.1
RHSA-2003:029 Released 2003-02-12 · Red Hat rating Low
: : : Updated lynx packages fix CRLF injection vulnerability
- Red Hat Linux 6.2
- Red Hat Linux 7.0
- Red Hat Linux 7.1
- Red Hat Linux 7.2
- Red Hat Linux 7.3
- Red Hat Linux 8.0

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1	Fixed	RHSA-2003:030
Red Hat Linux 6.2	Fixed	RHSA-2003:029
Red Hat Linux 7.0	Fixed	RHSA-2003:029
Red Hat Linux 7.1	Fixed	RHSA-2003:029
Red Hat Linux 7.2	Fixed	RHSA-2003:029
Red Hat Linux 7.3	Fixed	RHSA-2003:029
Red Hat Linux 8.0	Fixed	RHSA-2003:029
Red Hat Linux Advanced Workstation 2.1	Fixed	RHSA-2003:030

Timeline

2026-10-02 Threatist record created from CVE-2002-1405
2026-10-03 Alias added: GHSA-27fc-4jc3-pjvm

References

Patch 2

Advisory 4

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences