7.2
CVSSv3

CVE-2020-26116

Published: 27/09/2020 Updated: 07/11/2023
CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.2 | Impact Score: 2.7 | Exploitability Score: 3.9
VMScore: 570
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

Vulnerability Summary

http.client in Python 3.x prior to 3.5.10, 3.6.x prior to 3.6.12, 3.7.x prior to 3.7.9, and 3.8.x prior to 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

python python

fedoraproject fedora 31

fedoraproject fedora 32

fedoraproject fedora 33

canonical ubuntu linux 18.04

canonical ubuntu linux 14.04

canonical ubuntu linux 16.04

canonical ubuntu linux 12.04

netapp solidfire -

netapp hci storage node -

debian debian linux 9.0

oracle zfs storage appliance kit 8.8

opensuse leap 15.1

Vendor Advisories

Synopsis Moderate: rh-python36 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for rh-python36-python, rh-python36-python-pip, and rh-python36-python-virtualenv is now available for Red Hat Software CollectionsRed Hat Product Security has rated this updat ...
Synopsis Moderate: python27 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for python27-python, python27-python-pip, and python27-python-virtualenv is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having ...
Synopsis Moderate: rh-python38 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for rh-python38-python, rh-python38-python-psutil, and rh-python38-python-urllib3 is now available for Red Hat Software CollectionsRed Hat Product Security has rated this updat ...
概述 Moderate: python security update 类型/严重性 Security Advisory: Moderate 标题 An update for python is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating ...
Synopsis Moderate: Red Hat Advanced Cluster Management 2312 security updates and bug fixes Type/Severity Security Advisory: Moderate Topic Red Hat Advanced Cluster Management for Kubernetes 2312 GeneralAvailability release images, which provide security updates and bug fixesRed Hat Product Security has rated this update as having a secur ...
Synopsis Moderate: OpenShift Container Platform 311784 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 311784 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Pl ...
httpclient in Python 3x before 3510, 36x before 3612, 37x before 379, and 38x before 385 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnectionrequest (CVE-2020-26116) ...
A flaw was found in Python The built-in modules httplib and httpclient (included in Python 2 and Python 3, respectively) do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers The highest threat from this vulnerability is to confidentiality and int ...
A flaw was found in Python The built-in modules httplib and httpclient (included in Python 2 and Python 3, respectively) do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers The highest threat from this vulnerability is to confidentiality and int ...
httpclient in Python 3x before 3510, 36x before 3612, 37x before 379, and 38x before 385 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnectionrequest ...

Github Repositories

Security audit Python project dependencies against security advisory databases.

Skjold /skjɔl/ ,- | , ,- | ,-| `- |< | | | | | | Security audit python project dependencies `-' ' ` | `-' `' `-´ against several security advisory databases `' Introduction It currently supports fetching advisories from the following sou