ISOMAN

CVE

CVE-2020-26137

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Severity
MEDIUM
CVSS
6.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu20.04.6 amd64 desktopunknownsource
Ubuntu20.04.6 amd64 live-serverunknownsource
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource

References

  1. https://bugs.python.org/issue39603
  2. https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
  3. https://github.com/urllib3/urllib3/pull/1800
  4. https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
  5. https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
  6. https://usn.ubuntu.com/4570-1/
  7. https://www.oracle.com/security-alerts/cpujul2022.html
  8. https://www.oracle.com/security-alerts/cpuoct2021.html
  9. https://bugs.python.org/issue39603
  10. https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
  11. https://github.com/urllib3/urllib3/pull/1800
  12. https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
  13. https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
  14. https://usn.ubuntu.com/4570-1/
  15. https://www.oracle.com/security-alerts/cpujul2022.html
  16. https://www.oracle.com/security-alerts/cpuoct2021.html