PT-2020-6266 · Python+10 · Python+10
Published
2020-02-10
·
Updated
2025-08-11
·
CVE-2020-26116
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Python versions 3.x before 3.5.10
Python versions 3.6.x before 3.6.12
Python versions 3.7.x before 3.7.9
Python versions 3.8.x before 3.8.5
Description
The issue is related to a lack of output encoding or escaping mechanism in Python's HTTP request method. This can be exploited by a remote attacker to gain access to confidential data and compromise its integrity. The vulnerability can be exploited if the attacker controls the HTTP request method, for example, by inserting CR and LF control characters in the first argument of
HTTPConnection.request().Recommendations
For Python versions 3.x before 3.5.10, update to version 3.5.10 or later.
For Python versions 3.6.x before 3.6.12, update to version 3.6.12 or later.
For Python versions 3.7.x before 3.7.9, update to version 3.7.9 or later.
For Python versions 3.8.x before 3.8.5, update to version 3.8.5 or later.
Exploit
Fix
Special Elements Injection
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Python
Red Hat
Rocky Linux
Suse
Ubuntu