CVE-2020-26137
2 advisories.
PyPI/urllib3 CVE-2020-26137: medium 6.5
CRLF injection in urllib3
Action: Upgrade urllib3 to 1.25.9 or later.
pip install urllib3==1.25.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.25.9 | - |
Fixed versions
| 1.25.9 |
Sources
- osv: GHSA-wqvq-5m8c-6g24
- https://nvd.nist.gov/vuln/detail/CVE-2020-26137
- https://github.com/urllib3/urllib3/pull/1800
- https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
- https://bugs.python.org/issue39603
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2020-148.yaml
- https://github.com/urllib3/urllib3
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
- https://usn.ubuntu.com/4570-1
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
CVE-2020-26137 · published · modified · JSON
PyPI/urllib3 CVE-2020-26137: unknown
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: thi
Action: Upgrade urllib3 to 1.25.9 or later.
pip install urllib3==1.25.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.25.9 | - |
Fixed versions
| 1.25.9 |
Sources
- osv: PYSEC-2020-148
- https://bugs.python.org/issue39603
- https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
- https://github.com/urllib3/urllib3/pull/1800
- https://usn.ubuntu.com/4570-1/
- https://github.com/advisories/GHSA-wqvq-5m8c-6g24
CVE-2020-26137 · published · modified · JSON