Lucene search

[email protected]NVD:CVE-2020-26137

HistorySep 30, 2020 - 6:15 p.m.

CVE-2020-26137

2020-09-3018:15:26

CWE-74

[email protected]

web.nvd.nist.gov

urllib3 security vulnerability http request

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.007

Percentile

79.9%

JSON

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Affected configurations

Nvd

Node

pythonurllib3Range<1.25.9

Node

canonicalubuntu_linuxMatch16.04esm

canonicalubuntu_linuxMatch18.04lts

canonicalubuntu_linuxMatch20.04lts

Node

debiandebian_linuxMatch9.0

Node

oraclecommunications_cloud_native_core_network_function_cloud_native_environmentMatch22.2.0

oraclezfs_storage_appliance_kitMatch8.8

VendorProductVersionCPE
pythonurllib3*cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*
canonicalubuntu_linux16.04cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
canonicalubuntu_linux18.04cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
canonicalubuntu_linux20.04cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
oraclecommunications_cloud_native_core_network_function_cloud_native_environment22.2.0cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.2.0:*:*:*:*:*:*:*
oraclezfs_storage_appliance_kit8.8cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
python	urllib3	*	cpe:2.3:a:python:urllib3::::::::
canonical	ubuntu_linux	16.04	cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::
canonical	ubuntu_linux	18.04	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
canonical	ubuntu_linux	20.04	cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*
oracle	communications_cloud_native_core_network_function_cloud_native_environment	22.2.0	cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.2.0:::::::*
oracle	zfs_storage_appliance_kit	8.8	cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:::::::*