GitHub Advisoryadvisory · PyPI

GHSA-wqvq-5m8c-6g24 CRLF injection in urllib3

MEDIUM Published 2021-06-18 Modified 2024-11-18 Official page ↗
Aliases
CVE-2020-26137
Ecosystem
PyPI
Packages
urllib3
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-74
Reviewed
2021-06-17

Affected packages

• PyPI urllib3: < 1.25.9 → fixed in 1.25.9

Description

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of `putrequest()`. NOTE: this is similar to CVE-2020-26116.

Related

Alias · CVE (1)

  • CVE-2020-26137 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References