Yüksek CVSS 7.2 PoC var

CVE-2020-26116: Python: güvenlik açığı

Yayın: 27 Eylül 2020 07:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS: %6,36 (yüzdelik 94)
CWE: CWE-74
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	3.0.0	—	3.5.10
python-python	3.6.0	—	3.6.12
python-python	3.7.0	—	3.7.9
python-python	3.8.0	—	3.8.5
fedoraproject-fedora	31	31	—
fedoraproject-fedora	32	32	—
fedoraproject-fedora	33	33	—
canonical-ubuntu-linux	12.04	12.04	—
canonical-ubuntu-linux	14.04	14.04	—
canonical-ubuntu-linux	16.04	16.04	—
canonical-ubuntu-linux	18.04	18.04	—
netapp-solidfire	—	—	—
netapp-hci-storage-node	—	—	—
debian-debian-linux	9.0	9.0	—
oracle-zfs-storage-appliance-kit	8.8	8.8	—
opensuse-leap	15.1	15.1	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları