BIT-python-2020-26116

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2020-26116.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-python-2020-26116

Aliases

Published

2024-03-06T11:07:36.585Z

Modified

2024-03-06T11:25:28.861Z

Summary

[none]

Details

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Database specific

{
    "cpes": [
        "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / python

Package

Name: python
Purl: pkg:bitnami/python

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

3.0.0

Fixed

3.5.10

Introduced

3.6.0

Fixed

3.6.12

Introduced

3.7.0

Fixed

3.7.9

Introduced

3.8.0

Fixed

3.8.5