MitreCVELIST:CVE-2020-26116CVE-2020-26116
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
References
lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html
bugs.python.org/issue39603
lists.debian.org/debian-lts-announce/2020/11/msg00032.html
lists.debian.org/debian-lts-announce/2023/05/msg00024.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/
python-security.readthedocs.io/vuln/http-header-injection-method.html
security.gentoo.org/glsa/202101-18
security.netapp.com/advisory/ntap-20201023-0001/
usn.ubuntu.com/4581-1/
www.oracle.com/security-alerts/cpuoct2021.html
Related
