Strix
26.1K

CVE-2020-26116

HIGHCVSS 7.2/10EPSS 6.42%

Last modified

CVE-2020-26116 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.. EPSS estimates a 6.42% chance of exploitation in the next 30 days.

Description

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Metrics

CVSS 3.1
7.2/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Probability
6.42%

92.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
PythonPython>= 3.0.0, < 3.5.10
PythonPython>= 3.6.0, < 3.6.12
PythonPython>= 3.7.0, < 3.7.9
PythonPython>= 3.8.0, < 3.8.5
FedoraprojectFedora31
FedoraprojectFedora32
FedoraprojectFedora33
CanonicalUbuntu Linux12.04
CanonicalUbuntu Linux14.04
CanonicalUbuntu Linux16.04
CanonicalUbuntu Linux18.04
NetappSolidfireAll versions
NetappHci Storage NodeAll versions
DebianDebian Linux9.0
OracleZfs Storage Appliance Kit8.8
OpensuseLeap15.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-26116?
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
How severe is CVE-2020-26116?
CVE-2020-26116 has a CVSS score of 7.2/10 (HIGH severity). The EPSS model estimates a 6.42% probability of exploitation in the next 30 days.
How do I fix CVE-2020-26116?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-26116?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST