PT-2016-6647 · Python+5 · Urllib2+7

Published 2015-11-14 · Updated 2025-09-29 · CVE-2016-5699

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Python versions prior to 2.7.10 Python versions 3.x prior to 3.4.4

Description A CRLF injection issue exists in the HTTPConnection.putheader function in urllib2 and urllib, allowing remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

Recommendations For versions prior to 2.7.10, update to version 2.7.10 or later. For versions 3.x prior to 3.4.4, update to version 3.4.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-113

Related Identifiers

ALSA-2025_16880

ALT-PU-2015-1995

ALT-PU-2016-1294

CESA-2016_1626

CVE-2016-5699

DLA-1663-1

DLA-522-1

ELSA-2016-1626

MGASA-2016-0230

OPENSUSE-SU-2020:0086-1

OPENSUSE-SU-2020_0086-1

OPENSUSE-SU-2024:10193-1

OPENSUSE-SU-2024:10450-1

OPENSUSE-SU-2024:10536-1

OPENSUSE-SU-2024:11284-1

PSF-2016-8

RHSA-2016:1626

RHSA-2016:1627

RHSA-2016:1628

RHSA-2016:1629

RHSA-2016:1630

RHSA-2016_1626

SUSE-SU-2016:2106-1

SUSE-SU-2016:2270-1

SUSE-SU-2016:2653-1

SUSE-SU-2016:2859-1

SUSE-SU-2016_2106-1

SUSE-SU-2016_2270-1

SUSE-SU-2016_2653-1

SUSE-SU-2016_2859-1

SUSE-SU-2019:0223-1

SUSE-SU-2019_0223-1

SUSE-SU-2020:0114-1

SUSE-SU-2020:0234-1

SUSE-SU-2020_0114-1

SUSE-SU-2020_0234-1

USN-3134-1

Affected Products

Alt Linux

Centos

Python

Red Hat

Suse

Ubuntu

Urllib

Urllib2

References · 230

• 🔥 https://github.com/bunseokbot/CVE-2016-5699-poc · Exploit
• 🔥 http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html · Exploit
• https://osv.dev/vulnerability/DLA-1663-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5699 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-1627.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2653-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5699 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0230 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3134-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0223-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11284-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2859-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5636 · Vendor Advisory