CVE-2020-26137

Name	CVE-2020-26137
Description	urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2686-1, DLA-3610-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-urllib3 (PTS)	bullseye	1.26.5-1~exp1	fixed
	bookworm	1.26.12-1	fixed
	sid, trixie	2.0.7-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
python-urllib3	source	stretch	1.19.1-1+deb9u1	DLA-2686-1
python-urllib3	source	buster	1.24.1-1+deb10u1	DLA-3610-1
python-urllib3	source	(unstable)	1.25.9-1

Notes

https://bugs.python.org/issue39603
https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b (1.25.9)
https://github.com/urllib3/urllib3/pull/1800