CVE-2020-26116: CRLF Injection

A security issue was found in Python. Built-in modules httplib/http.client do not properly validate CRLF sequences in the HTTP request method, potentially allowing to manipulate the request by injecting additional HTTP headers.

Vulnerable modules: httplib (Python 2) http.client (Python 3)

References: https://python-security.readthedocs.io/vuln/http-header-injection-method.html https://bugs.python.org/issue39603

Upstream patch PR (merged upstream): https://github.com/python/cpython/pull/18485

Upstream commits: https://github.com/python/cpython/commit/8ca8a2e8fb068863c1138f07e3098478ef8be12e [master] https://github.com/python/cpython/commit/668d321476d974c4f51476b33aaca870272523bf [python-3.8.5] https://github.com/python/cpython/commit/ca75fec1ed358f7324272608ca952b2d8226d11a [python-3.7.9] https://github.com/python/cpython/commit/f02de961b9f19a5db0ead56305fe0057a78787ae [python-3.6.12] https://github.com/python/cpython/commit/524b8de630036a29ca340bc2ae6fd6dc7dda8f40 [python-3.5.10]

— Red Hat

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Python is vulnerable to CRLF injection, caused by improper validation of user-supplied input in http.client. By inserting CR and LF control characters in the first argument of HTTPConnection.request, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

— IBM