CVE-2020-26116
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-26116
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-26116.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-26116
- Aliases
- Related
- Published
- 2020-09-27T04:15:11Z
- Modified
- 2024-10-12T04:41:57.090720Z
- Severity
-
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
- References
-
- https://bugs.python.org/issue39603
- https://security.gentoo.org/glsa/202101-18
- https://security.netapp.com/advisory/ntap-20201023-0001/
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html
- https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html
- https://python-security.readthedocs.io/vuln/http-header-injection-method.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/
- https://usn.ubuntu.com/4581-1/
- https://security-tracker.debian.org/tracker/CVE-2020-26116
Affected packages
Debian:11 / pypy3
Package
- Name
- pypy3
- Purl
- pkg:deb/debian/pypy3?arch=source
Debian:12 / pypy3
Package
- Name
- pypy3
- Purl
- pkg:deb/debian/pypy3?arch=source
Debian:13 / pypy3
Package
- Name
- pypy3
- Purl
- pkg:deb/debian/pypy3?arch=source
Debian:11 / python2.7
Package
- Name
- python2.7
- Purl
- pkg:deb/debian/python2.7?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:11 / python3.9
Package
- Name
- python3.9
- Purl
- pkg:deb/debian/python3.9?arch=source