CRLF injection in urllib3
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of `putrequest()`. NOTE: this is similar to CVE-2020-26116.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-26137US | medium6.5 | — | ||
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of put… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://bugs.python.org/issue39603WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2020-148.yamlWEB
- https://github.com/urllib3/urllib3PACKAGE
- https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436bWEB
- https://github.com/urllib3/urllib3/pull/1800WEB
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.htmlWEB
- https://lists.debian.org/debian-lts-announce/2023/10/msg00012.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-26137ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan