CVE-2016-5699

NameCVE-2016-5699
DescriptionCRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1663-1, DLA-522-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)jessie2.7.9-2+deb8u1fixed
jessie (security)2.7.9-2+deb8u2fixed
stretch (security), stretch2.7.13-2+deb9u3fixed
buster, sid2.7.16-2fixed
python3.4 (PTS)jessie3.4.2-1vulnerable
jessie (security)3.4.2-1+deb8u2fixed
python3.5 (PTS)stretch (security), stretch3.5.3-1+deb9u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.7source(unstable)2.7.10~rc1-1medium
python2.7sourcejessie2.7.9-2+deb8u1medium
python2.7sourcewheezy2.7.3-6+deb7u3mediumDLA-522-1
python3.4source(unstable)3.4.4~rc1-1medium
python3.4sourcejessie3.4.2-1+deb8u2mediumDLA-1663-1
python3.5source(unstable)(not affected)

Notes

- python3.5 <not-affected> (Fixed with initial upload to Debian)
https://bugs.python.org/issue22928
Fixed in 3.4 / 3.5: revision 94952: https://hg.python.org/cpython/rev/bf3e1c9b80e9
Fixed in 2.7: revision 94951: https://hg.python.org/cpython/rev/1c45047c5102

Search for package or bug name: Reporting problems