HTTP Header Injection Affecting urllib3 package, versions [,1.25.9)
Threat Intelligence
EPSS
0.65% (80th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-URLLIB3-1014645
- published 1 Oct 2020
- disclosed 1 Oct 2020
- credit maxpl0it
Introduced: 1 Oct 2020
CVE-2020-26137 Open this link in a new tabHow to fix?
Upgrade urllib3 to version 1.25.9 or higher.
Overview
urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.
Affected versions of this package are vulnerable to HTTP Header Injection. The 'method' parameter is not filtered to prevent the injection from altering the entire request.
For example:
>>> conn = http.client.HTTPConnection("localhost", 80)
>>> conn.request(method="GET / HTTP/1.1\r\nHost: abc\r\nRemainder:", url="/index.html")
This will result in the following request being generated:
GET / HTTP/1.1
Host: abc
Remainder: /index.html HTTP/1.1
Host: localhost
Accept-Encoding: identity
References
CVSS Scores
version 3.1