NetSight
IP …
high7.2

CVE-2020-26116

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTT…

Impact

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Affected products

VendorProductAffected versions
PythonPython
from 3.0.0 before 3.5.10
from 3.6.0 before 3.6.12
from 3.7.0 before 3.7.9
from 3.8.0 before 3.8.5
FedoraprojectFedora
Versions 31, 32, 33
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04
NetappSolidfire
All versions
NetappHci Storage Node
All versions
DebianDebian Linux
Version 9.0
OracleZfs Storage Appliance Kit
Version 8.8
OpensuseLeap
Version 15.1

Weakness classification

CWE-74

References