6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
httplib library (used by urllib, urllib2 and others) in Python is vulnerable to CRLF injection attacks. The vulnerability exists because it fails to sufficiently sanitize user input. This allows remote attackers to inject additional headers in a Python application that allowed user provided header names or values.
blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
rhn.redhat.com/errata/RHSA-2016-1626.html
rhn.redhat.com/errata/RHSA-2016-1627.html
rhn.redhat.com/errata/RHSA-2016-1628.html
rhn.redhat.com/errata/RHSA-2016-1629.html
rhn.redhat.com/errata/RHSA-2016-1630.html
www.openwall.com/lists/oss-security/2016/06/14/7
www.openwall.com/lists/oss-security/2016/06/15/12
www.openwall.com/lists/oss-security/2016/06/16/2
www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
www.securityfocus.com/bid/91226
www.splunk.com/view/SP-CAAAPSV
www.splunk.com/view/SP-CAAAPUE
access.redhat.com/errata/RHSA-2016:1626
access.redhat.com/errata/RHSA-2016:1627
access.redhat.com/errata/RHSA-2016:1628
access.redhat.com/errata/RHSA-2016:1629
access.redhat.com/errata/RHSA-2016:1630
access.redhat.com/security/cve/CVE-2016-5699
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=1303699
bugzilla.redhat.com/show_bug.cgi?id=1351584
bugzilla.redhat.com/show_bug.cgi?id=1365200
docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4
hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS
hg.python.org/cpython/rev/1c45047c5102
hg.python.org/cpython/rev/bf3e1c9b80e9
lists.debian.org/debian-lts-announce/2019/02/msg00011.html
rhn.redhat.com/errata/RHSA-2016-1626.html
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N