CVE-2020-26137: CRLF injection in urllib3
(updated )
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
References
- bugs.python.org/issue39603
- github.com/advisories/GHSA-wqvq-5m8c-6g24
- github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2020-148.yaml
- github.com/urllib3/urllib3
- github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
- github.com/urllib3/urllib3/pull/1800
- lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- lists.debian.org/debian-lts-announce/2023/10/msg00012.html
- nvd.nist.gov/vuln/detail/CVE-2020-26137
- usn.ubuntu.com/4570-1
- www.oracle.com/security-alerts/cpujul2022.html
- www.oracle.com/security-alerts/cpuoct2021.html
Code Behaviors & Features
Detect and mitigate CVE-2020-26137 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →