K000133759 : Python vulnerability CVE-2020-26116

Security Advisory Description

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

Impact

An attacker may use this vulnerability to inject additional HTTP headers using the HTTP method, which allows the attacker to perform a smuggling attack and can also allow a client to bypass HTTP headers with security purposes.