~ / search / GHSA-wqvq-5m8c-6g24

GHSA-wqvq-5m8c-6g24

CRLF injection in urllib3

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-26137

Packages

EcosystemPackageAffectedFixed in
PyPI urllib3 < 1.25.9 1.25.9

Details

As written in the advisory (Markdown source, shown as plain text).

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of `putrequest()`. NOTE: this is similar to CVE-2020-26116.

References

External links from the advisory. They lead to third-party sites.