745051 – (CVE-2020-26166) dev-lang/python: CRLF injection if the attacker controls the HTTP request method (CVE-2020-26166)

Bug 745051 (CVE-2020-26166) - dev-lang/python: CRLF injection if the attacker controls the HTTP request method (CVE-2020-26166)

Summary: dev-lang/python: CRLF injection if the attacker controls the HTTP request met...

Status:	RESOLVED INVALID

Alias:	CVE-2020-26166

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://python-security.readthedocs.i...
Whiteboard:	A4 [stable]?
Keywords:

Depends on:
Blocks:

Reported:	2020-09-28 08:38 UTC by filip ambroz
Modified:	2020-09-28 14:26 UTC (History)
CC List:	3 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description filip ambroz 2020-09-28 08:38:42 UTC

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Links:
https://bugs.python.org/issue39603
https://nvd.nist.gov/vuln/detail/CVE-2020-26116
https://www.tenable.com/cve/CVE-2020-26116
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26116
https://vuldb.com/?id.162034


Reproducible: Always

Comment 1 filip ambroz 2020-09-28 08:47:38 UTC

Solution:
Upgrading to version 3.5.10, 3.6.12, 3.7.9 or 3.8.5 eliminates this vulnerability.

(Currently we have 3.6.11-r2 and 3.7.8-r2 in repos.)

Comment 2 Michał Górny archtester

2020-09-28 09:06:35 UTC

Actually, I'm pretty sure I've backported this fix to all slots.

Comment 3 John Helmert III archtester

2020-09-28 14:26:12 UTC

This appears to have been handled in bug 728668 (>python:2) and bug 741502 (python:2). Filip, if a fix was not actually backported please reopen and let us know.