Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM265D1B6C4A3FAAA6603A120CE1D705D05BDC2BDAD6FFBD61AC5A18B875B14E1F
HistoryDec 04, 2020 - 6:34 a.m.

Security Bulletin: Vulnerability in Urllib3 affects IBM Spectrum Protect Container and Microsoft File Systems Agents (CVE-2020-26137)

2020-12-0406:34:59
www.ibm.com
12

0.004 Low

EPSS

Percentile

74.7%

JSON

Summary

Urllib3 is vulnerable to CRLF injection which could allow a remote attacker to perform cross-site scripting, cache poisoning, or session hijacking attacks. This vulnerability may affect the IBM Spectrum Protect Plus Container agent for Kubernetes and the IBM Spectrum Protect Plus Microsoft® Windows File Systems agent.

Vulnerability Details

CVEID:CVE-2020-26137
**DESCRIPTION:**urllib3 is vulnerable to CRLF injection. By inserting CR and LF control characters in the first argument of putrequest(), a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/189426 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Spectrum Protect Plus Container Agent for Kubernetes (Linux) 10.1.5-10.1.6
IBM Spectrum Protect Plus Microsoft File Systems Agent (Windows) 10.1.6

Remediation/Fixes

Spectrum Protect Plus Release First Fixing VRM Level Platform Link to Fix
10.1 10.1.7 Linux
Windows <https://www.ibm.com/support/pages/node/6330495&gt;

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm spectrum protect pluseq10.1

Related

osv 10
openvas 14
amazon 1
ibm 12
suse 4
cbl_mariner 1
mageia 2
ubuntu 1
veracode 1
rocky 2
nessus 45
redhatcve 1
oraclelinux 3
almalinux 2
redhat 14
ubuntucve 1
cve 1
cvelist 1
nvd 1
prion 1
github 1
f5 1
alpinelinux 1
debiancve 1
centos 1
debian 2
rosalinux 1
photon 5
oracle 2
osv
osv
Moderate: python-urllib3 security update
2021-05-18 05:42:27
Moderate: python-urllib3 security update
2021-05-18 05:42:27
python-urllib3 vulnerability
2020-10-05 17:04:30
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2020:3723-1)
2021-06-09 00:00:00
Ubuntu: Security Advisory (USN-4570-1)
2020-10-06 00:00:00
SUSE: Security Advisory (SUSE-SU-2021:3251-1)
2021-09-30 00:00:00
amazon
amazon
Medium: python-urllib3
2021-06-16 20:37:00
ibm
ibm
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to CRLF injection in Python urllib3 [CVE-2020-26137]
2024-02-29 20:30:41
Security Bulletin: A vulnerability in urlib3 affects IBM Robotic Process Automation for Cloud Pak which may result in CRLF injection (CVE-2020-26137).
2023-08-21 17:54:57
Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to multiple vulnerabilities (CVE-2019-11236, CVE-2020-26137, CVE-2021-33503)
2023-12-06 16:00:11
suse
suse
Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3 (moderate)
2021-08-23 00:00:00
Security update for python-urllib3 (moderate)
2020-12-18 00:00:00
Security update for python-urllib3 (moderate)
2020-12-13 00:00:00
cbl_mariner
cbl_mariner
CVE-2020-26137 affecting package python-urllib3 1.24.2-2
2021-08-11 06:39:25
mageia
mageia
Updated python-urllib3 packages fix security vulnerability
2021-01-25 18:25:52
Updated python-pip packages fix security vulnerabilities
2021-01-25 18:25:52
ubuntu
ubuntu
urllib3 vulnerability
2020-10-05 00:00:00
veracode
veracode
Carriage-Return Line-Feed (CRLF) Injection
2020-10-01 01:43:17
rocky
rocky
python-urllib3 security update
2021-05-18 05:42:27
python27:2.7 security and bug fix update
2021-05-18 06:02:07
nessus
nessus
openSUSE Security Update : python-urllib3 (openSUSE-2020-2282)
2021-01-25 00:00:00
openSUSE Security Update : python-urllib3 (openSUSE-2020-2237)
2020-12-16 00:00:00
CentOS 8 : python-urllib3 (CESA-2021:1631)
2021-05-19 00:00:00
redhatcve
redhatcve
CVE-2020-26137
2020-09-29 19:03:30
oraclelinux
oraclelinux
python-urllib3 security update
2021-05-25 00:00:00
python security update
2022-07-02 00:00:00
python27:2.7 security and bug fix update
2021-05-25 00:00:00
almalinux
almalinux
Moderate: python-urllib3 security update
2021-05-18 05:42:27
Moderate: python27:2.7 security and bug fix update
2021-05-18 06:02:07
redhat
redhat
(RHSA-2021:1631) Moderate: python-urllib3 security update
2021-05-18 05:42:27
(RHSA-2021:0079) Moderate: OpenShift Container Platform 3.11.374 bug fix and security update
2021-01-20 16:38:11
(RHSA-2022:5235) Moderate: python security update
2022-06-28 07:52:39
ubuntucve
ubuntucve
CVE-2020-26137
2020-09-30 00:00:00
cve
cve
CVE-2020-26137
2020-09-30 18:15:26
cvelist
cvelist
CVE-2020-26137
2020-09-29 00:00:00
nvd
nvd
CVE-2020-26137
2020-09-30 18:15:26
prion
prion
Crlf injection
2020-09-30 18:15:00
github
github
CRLF injection in urllib3
2021-06-18 18:46:43
f5
f5
K000133547 : Python urllib3 vulnerability CVE-2020-26137
2023-04-18 00:00:00
alpinelinux
alpinelinux
CVE-2020-26137
2020-09-30 18:15:26
debiancve
debiancve
CVE-2020-26137
2020-09-30 18:15:26
centos
centos
python, tkinter security update
2022-08-02 19:15:12
debian
debian
[SECURITY] [DLA 2686-1] python-urllib3 security update
2021-06-15 18:34:44
[SECURITY] [DLA 3610-1] python-urllib3 security update
2023-10-08 11:06:20
rosalinux
rosalinux
Advisory ROSA-SA-2023-2203
2023-08-01 12:58:39
photon
photon
Critical Photon OS Security Update - PHSA-2021-0442
2021-10-13 00:00:00
Important Photon OS Security Update - PHSA-2021-0246
2021-06-02 00:00:00
Important Photon OS Security Update - PHSA-2021-3.0-0246
2021-06-02 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00
Oracle Critical Patch Update Advisory - October 2021
2021-10-19 00:00:00

0.004 Low

EPSS

Percentile

74.7%

JSON
Related for 265D1B6C4A3FAAA6603A120CE1D705D05BDC2BDAD6FFBD61AC5A18B875B14E1F
osv10openvas14amazon1ibm12suse4cbl_mariner1mageia2ubuntu1veracode1rocky2nessus45redhatcve1oraclelinux3almalinux2redhat14ubuntucve1cve1cvelist1nvd1prion1github1f51alpinelinux1debiancve1centos1debian2rosalinux1photon5oracle2