p PatchFirst

CVE-2020-26137

CVE-2020-26137

This page contains facts from public vulnerability sources. Check the original advisory before updating.

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

CVSS 6.5 · Medium · EPSS 2.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-urllib3 Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.25.9-1

    Update to 1.25.9-1

  • python-urllib3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.25.9-1

    Update to 1.25.9-1

  • python-urllib3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.25.9-1

    Update to 1.25.9-1

  • urllib3 PyPI

    Versions
    • 0.2
    • 0.3
    • 0.3.1
    • 0.4.0
    • 0.4.1
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.1
    • 1.10
    • 1.10.1
    • 1.10.2
    • 1.10.3
    • 1.10.4
    • 1.11
    • 1.12
    • 1.13
    • 1.13.1
    • 1.14
    • 1.15
    • 1.15.1
    • 1.16
    • 1.17
    • 1.18
    • 1.18.1
    • 1.19
    • 1.19.1
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.20
    • 1.21
    • 1.21.1
    • 1.22
    • 1.23
    • 1.24
    • 1.24.1
    • 1.24.2
    • 1.24.3
    • 1.25
    • 1.25.1
    • 1.25.2
    • 1.25.3
    • 1.25.4
    • 1.25.5
    • 1.25.6
    • 1.25.7
    • 1.25.8
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7
    • 1.7.1
    • 1.8
    • 1.8.2
    • 1.8.3
    • 1.9
    • 1.9.1
    Affected ranges
    • ECOSYSTEM: < 1.25.9

    Update to 1.25.9

  • urllib3 PyPI

    Versions
    • 0.2
    • 0.3
    • 0.3.1
    • 0.4.0
    • 0.4.1
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.1
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7
    • 1.7.1
    • 1.8
    • 1.8.2
    • 1.8.3
    • 1.9
    • 1.9.1
    • 1.10
    • 1.10.1
    • 1.10.2
    • 1.10.3
    • 1.10.4
    • 1.11
    • 1.12
    • 1.13
    • 1.13.1
    • 1.14
    • 1.15
    • 1.15.1
    • 1.16
    • 1.17
    • 1.18
    • 1.18.1
    • 1.19
    • 1.19.1
    • 1.20
    • 1.21
    • 1.21.1
    • 1.22
    • 1.23
    • 1.24
    • 1.24.1
    • 1.24.2
    • 1.24.3
    • 1.25
    • 1.25.1
    • 1.25.2
    • 1.25.3
    • 1.25.4
    • 1.25.5
    • 1.25.6
    • 1.25.7
    • 1.25.8
    Affected ranges
    • GIT: < 1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
    • ECOSYSTEM: < 1.25.9

    Update to 1.25.9

  • python-pip Ubuntu:Pro:14.04:LTS

    Versions
    • 1.4.1-2
    • 1.5.4-1
    • 1.5.4-1ubuntu1
    • 1.5.4-1ubuntu3
    • 1.5.4-1ubuntu4
    • 1.5.4-1ubuntu4+esm1
    • 1.5.4-1ubuntu4+esm2
    • 1.5.4-1ubuntu4+esm3
    • 1.5.4-1ubuntu4+esm4
    • 1.5.4-1ubuntu4+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:16.04:LTS

    Versions
    • 1.5.6-7ubuntu1
    • 1.5.6-7ubuntu2
    • 8.0.2-7
    • 8.0.3-1
    • 8.0.3-2
    • 8.1.0-1
    • 8.1.0-2
    • 8.1.1-1
    • 8.1.1-2
    • 8.1.1-2ubuntu0.1
    • 8.1.1-2ubuntu0.2
    • 8.1.1-2ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 8.1.1-2ubuntu0.6

    Update to 8.1.1-2ubuntu0.6

  • python-urllib3 Ubuntu:16.04:LTS

    Versions
    • 1.11-1
    • 1.12-1
    • 1.13.1-1
    • 1.13.1-2
    • 1.13.1-2ubuntu0.16.04.1
    • 1.13.1-2ubuntu0.16.04.2
    • 1.13.1-2ubuntu0.16.04.3
    Affected ranges
    • ECOSYSTEM: < 1.13.1-2ubuntu0.16.04.4

    Update to 1.13.1-2ubuntu0.16.04.4

  • python-pip Ubuntu:18.04:LTS

    Versions
    • 9.0.1-2
    • 9.0.1-2.3~ubuntu1
    • 9.0.1-2.3~ubuntu1.18.04.1
    • 9.0.1-2.3~ubuntu1.18.04.2
    Affected ranges
    • ECOSYSTEM: < 9.0.1-2.3~ubuntu1.18.04.3

    Update to 9.0.1-2.3~ubuntu1.18.04.3

  • python-urllib3 Ubuntu:18.04:LTS

    Versions
    • 1.21.1-1
    • 1.22-1
    • 1.22-1ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: < 1.22-1ubuntu0.18.04.2

    Update to 1.22-1ubuntu0.18.04.2

  • python-pip Ubuntu:20.04:LTS

    Versions
    • 18.1-5
    • 18.1-5build1
    • 18.1-5ubuntu1
    • 20.0.2-2
    • 20.0.2-4
    • 20.0.2-5
    • 20.0.2-5ubuntu1
    Affected ranges
    • ECOSYSTEM: < 20.0.2-5ubuntu1.1

    Update to 20.0.2-5ubuntu1.1

  • python-urllib3 Ubuntu:20.04:LTS

    Versions
    • 1.24.1-1ubuntu1
    • 1.24.1-1ubuntu2
    • 1.25.8-1
    • 1.25.8-2
    Affected ranges
    • ECOSYSTEM: < 1.25.8-2ubuntu0.1

    Update to 1.25.8-2ubuntu0.1

Original sources

Check your server →