Lucene search
Veracode Vulnerability DatabaseVERACODE:27288HistoryOct 01, 2020 - 1:43 a.m.
Carriage-Return Line-Feed (CRLF) Injection
2020-10-0101:43:17
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
32
0.004 Low
EPSS
Percentile
74.7%
urllib3 is vulnerable to carriage-return line-feed (CRLF) injection. The vulnerability exists as it does not sufficiently check for non-token characters, allowing characters such as \r, \n to be parsed and interpreted.
References
bugs.python.org/issue39603
bugzilla.redhat.com/show_bug.cgi?id=1883870
github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b
github.com/urllib3/urllib3/pull/1800
lists.debian.org/debian-lts-announce/2021/06/msg00015.html
usn.ubuntu.com/4570-1/
www.oracle.com/security-alerts/cpujul2022.html
www.oracle.com/security-alerts/cpuoct2021.html
Related
osv
osv
Moderate: python-urllib3 security update
2021-05-18 05:42:27
Moderate: python-urllib3 security update
2021-05-18 05:42:27
python-urllib3 vulnerability
2020-10-05 17:04:30
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2020:3723-1)
2021-06-09 00:00:00
Mageia: Security Advisory (MGASA-2021-0055)
2022-01-28 00:00:00
openSUSE: Security Advisory for aws-cli, (openSUSE-SU-2021:2817-1)
2021-08-24 00:00:00
suse
suse
Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3 (moderate)
2021-08-23 00:00:00
Security update for python-urllib3 (moderate)
2020-12-18 00:00:00
Security update for python-urllib3 (moderate)
2020-12-13 00:00:00
amazon
amazon
Medium: python-urllib3
2021-06-16 20:37:00
ibm
ibm
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to CRLF injection in Python urllib3 [CVE-2020-26137]
2024-02-29 20:30:41
rocky
rocky
python-urllib3 security update
2021-05-18 05:42:27
python27:2.7 security and bug fix update
2021-05-18 06:02:07
nessus
nessus
openSUSE Security Update : python-urllib3 (openSUSE-2020-2237)
2020-12-16 00:00:00
openSUSE Security Update : python-urllib3 (openSUSE-2020-2282)
2021-01-25 00:00:00
CentOS 8 : python-urllib3 (CESA-2021:1631)
2021-05-19 00:00:00
redhat
redhat
(RHSA-2021:1631) Moderate: python-urllib3 security update
2021-05-18 05:42:27
(RHSA-2021:0079) Moderate: OpenShift Container Platform 3.11.374 bug fix and security update
2021-01-20 16:38:11
(RHSA-2022:5235) Moderate: python security update
2022-06-28 07:52:39
cbl_mariner
cbl_mariner
CVE-2020-26137 affecting package python-urllib3 1.24.2-2
2021-08-11 06:39:25
mageia
mageia
Updated python-urllib3 packages fix security vulnerability
2021-01-25 18:25:52
Updated python-pip packages fix security vulnerabilities
2021-01-25 18:25:52
ubuntu
ubuntu
urllib3 vulnerability
2020-10-05 00:00:00
redhatcve
redhatcve
CVE-2020-26137
2020-09-29 19:03:30
oraclelinux
oraclelinux
python-urllib3 security update
2021-05-25 00:00:00
python security update
2022-07-02 00:00:00
python27:2.7 security and bug fix update
2021-05-25 00:00:00
almalinux
almalinux
Moderate: python-urllib3 security update
2021-05-18 05:42:27
Moderate: python27:2.7 security and bug fix update
2021-05-18 06:02:07
prion
prion
Crlf injection
2020-09-30 18:15:00
github
github
CRLF injection in urllib3
2021-06-18 18:46:43
ubuntucve
ubuntucve
CVE-2020-26137
2020-09-30 00:00:00
cve
cve
CVE-2020-26137
2020-09-30 18:15:26
cvelist
cvelist
CVE-2020-26137
2020-09-29 00:00:00
nvd
nvd
CVE-2020-26137
2020-09-30 18:15:26
debiancve
debiancve
CVE-2020-26137
2020-09-30 18:15:26
f5
f5
K000133547 : Python urllib3 vulnerability CVE-2020-26137
2023-04-18 00:00:00
alpinelinux
alpinelinux
CVE-2020-26137
2020-09-30 18:15:26
centos
centos
python, tkinter security update
2022-08-02 19:15:12
debian
debian
[SECURITY] [DLA 2686-1] python-urllib3 security update
2021-06-15 18:34:44
[SECURITY] [DLA 3610-1] python-urllib3 security update
2023-10-08 11:06:20
photon
photon
Critical Photon OS Security Update - PHSA-2021-0442
2021-10-13 00:00:00
Important Photon OS Security Update - PHSA-2021-0246
2021-06-02 00:00:00
Important Photon OS Security Update - PHSA-2021-3.0-0246
2021-06-02 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2203
2023-08-01 12:58:39
oracle
oracle
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00
Oracle Critical Patch Update Advisory - October 2021
2021-10-19 00:00:00