CVE-2016-5699 CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP....
MediumCVSS 6.1
EPSS 9.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python2.7(Debian:11) | < 2.7.10~rc1-1 | 2.7.10~rc1-1 |
| python | <= 2.7.9 | No fix listed |
| python | = 3.0 | No fix listed |
| python | = 3.0.1 | No fix listed |
| python | = 3.1.0 | No fix listed |
| python | = 3.1.1 | No fix listed |
| python | = 3.1.2 | No fix listed |
| python | = 3.1.3 | No fix listed |
| python | = 3.1.4 | No fix listed |
| python | = 3.1.5 | No fix listed |
| python | = 3.2.0 | No fix listed |
| python | = 3.2.1 | No fix listed |
| python | = 3.2.2 | No fix listed |
| python | = 3.2.3 | No fix listed |
| python | = 3.2.4 | No fix listed |
| python | = 3.2.5 | No fix listed |
| python | = 3.2.6 | No fix listed |
| python | = 3.3.0 | No fix listed |
| python | = 3.3.1 | No fix listed |
| python | = 3.3.2 | No fix listed |
| python | = 3.3.3 | No fix listed |
| python | = 3.3.4 | No fix listed |
| python | = 3.3.5 | No fix listed |
| python | = 3.3.6 | No fix listed |
| python | = 3.4.0 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| python | = 3.4.1 | No fix listed |
| python | = 3.4.2 | No fix listed |
| python | = 3.4.3 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- blog.blindspotsecurity.com exploit third-party-advisory
- openSUSE-SU-2020:0086 vendor-advisory
- RHSA-2016:1626 vendor-advisory
- RHSA-2016:1627 vendor-advisory
- RHSA-2016:1628 vendor-advisory
- RHSA-2016:1629 vendor-advisory
- RHSA-2016:1630 vendor-advisory
- [oss-security] 20160614 CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client mailing-list
- [oss-security] 20160615 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client mailing-list
- [oss-security] 20160616 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client mailing-list
- www.oracle.com
- 91226 vdb-entry
- www.splunk.com
- www.splunk.com
- docs.python.org release-notes
- hg.python.org release-notes
- hg.python.org patch
- hg.python.org patch
- [debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update mailing-list