PT-2016-6647 · Python+5 · Urllib2+7

Publicado

2015-11-14

·

Atualizado

2025-09-29

·

CVE-2016-5699

CVSS v3.1

6.1

Média

VetorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Python versions prior to 2.7.10 Python versions 3.x prior to 3.4.4
Description A CRLF injection issue exists in the HTTPConnection.putheader function in urllib2 and urllib, allowing remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
Recommendations For versions prior to 2.7.10, update to version 2.7.10 or later. For versions 3.x prior to 3.4.4, update to version 3.4.4 or later.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-113

Identificadores relacionados

ALSA-2025_16880
ALT-PU-2015-1995
ALT-PU-2016-1294
CESA-2016_1626
CVE-2016-5699
DLA-1663-1
DLA-522-1
ELSA-2016-1626
MGASA-2016-0230
OPENSUSE-SU-2020:0086-1
OPENSUSE-SU-2020_0086-1
OPENSUSE-SU-2024:10193-1
OPENSUSE-SU-2024:10450-1
OPENSUSE-SU-2024:10536-1
OPENSUSE-SU-2024:11284-1
PSF-2016-8
RHSA-2016:1626
RHSA-2016:1627
RHSA-2016:1628
RHSA-2016:1629
RHSA-2016:1630
RHSA-2016_1626
SUSE-SU-2016:2106-1
SUSE-SU-2016:2270-1
SUSE-SU-2016:2653-1
SUSE-SU-2016:2859-1
SUSE-SU-2016_2106-1
SUSE-SU-2016_2270-1
SUSE-SU-2016_2653-1
SUSE-SU-2016_2859-1
SUSE-SU-2019:0223-1
SUSE-SU-2019_0223-1
SUSE-SU-2020:0114-1
SUSE-SU-2020:0234-1
SUSE-SU-2020_0114-1
SUSE-SU-2020_0234-1
USN-3134-1

Produtos afetados

Alt Linux
Centos
Python
Red Hat
Suse
Ubuntu
Urllib
Urllib2