medium6.5
CVE-2020-26137
CRLF injection in urllib3
Impact
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of `putrequest()`. NOTE: this is similar to CVE-2020-26116.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | urllib3 | < 1.25.9 | 1.25.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Python | Urllib3 | before 1.25.9 |
| Canonical | Ubuntu Linux | Versions 16.04, 18.04, 20.04 |
| Debian | Debian Linux | Version 9.0 |
| Oracle | Communications Cloud Native Core Network Function Cloud Native Environment | Version 22.2.0 |
| Oracle | Zfs Storage Appliance Kit | Version 8.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugs.python.org/issue39603
- https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
- https://github.com/urllib3/urllib3/pull/1800
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
- https://usn.ubuntu.com/4570-1/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/advisories/GHSA-wqvq-5m8c-6g24
- https://nvd.nist.gov/vuln/detail/CVE-2020-26137
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2020-148.yaml
- https://usn.ubuntu.com/4570-1