CVE-2020-26137

NameCVE-2020-26137
Descriptionurllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2686-1, DLA-3610-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-urllib3 (PTS)bullseye1.26.5-1~exp1fixed
bookworm1.26.12-1fixed
trixie1.26.18-2fixed
sid2.0.7-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-urllib3sourcestretch1.19.1-1+deb9u1DLA-2686-1
python-urllib3sourcebuster1.24.1-1+deb10u1DLA-3610-1
python-urllib3source(unstable)1.25.9-1

Notes

https://bugs.python.org/issue39603
https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b (1.25.9)
https://github.com/urllib3/urllib3/pull/1800

Search for package or bug name: Reporting problems