Unrated
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control character...
CVE-2020-26137
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2020-26137 py3-urllib3 Fixed in: 1.25.9-r0
- Debian DEBIAN-CVE-2020-26137 python-urllib3 Fixed in: 1.25.9-1
Original description The description as published by the source.
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory lists.debian.org
- advisory usn.ubuntu.com
- patch github.com
- patch github.com
- patch oracle.com
- patch oracle.com
- report bugs.python.org
- web lists.debian.org