Description
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected products
- Canonical / Ubuntu Linux12.04 – 12.04
- Canonical / Ubuntu Linux18.04 – 18.04
- Canonical / Ubuntu Linux16.04 – 16.04
- Canonical / Ubuntu Linux14.04 – 14.04
- Debian / debian_linux9.0 – 9.0
- fedoraproject / fedora33 – 33
- fedoraproject / fedora32 – 32
- fedoraproject / fedora31 – 31
- NetApp / hci_storage_node
- NetApp / solidfire
- openSUSE / Leap15.1 – 15.1
- oracle / zfs_storage_appliance_kit8.8 – 8.8
- Python / python3.0.0 – 3.5.10
References
- MISChttps://python-security.readthedocs.io/vuln/http-header-injection-method.html
- MISChttps://bugs.python.org/issue39603
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/
- VENDOR_ADVISORYhttps://usn.ubuntu.com/4581-1/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/11/msg00032.html
- MISChttps://security.gentoo.org/glsa/202101-18
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
- MISChttps://security.netapp.com/advisory/ntap-20201023-0001/
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
Updated 16m ago · 8 sources