CRLF Injection Vulnerability in urllib3 Package
Summary
UBUNTU-CVE-2020-26137: urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
urllib3 is a powerful, user-friendly HTTP client for Python that provides features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. It is widely used in various applications for making HTTP requests. However, a vulnerability has been identified in urllib3 that allows for CRLF (Carriage Return Line Feed) injection, which can lead to security issues if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2020-26137, allows an attacker to inject CR and LF control characters into the HTTP request method. This can lead to CRLF injection, which may allow the attacker to manipulate the HTTP response headers, potentially leading to security breaches such as response splitting or cache poisoning. The vulnerability affects versions of urllib3 prior to 1.25.9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot immediately update the package, consider implementing input validation to sanitize HTTP request methods and prevent the injection of CR and LF characters. This can help mitigate the risk until the package is updated.
Conclusion
The CRLF injection vulnerability in the urllib3 package poses a significant risk to applications that utilize this library for HTTP requests. It is essential to update to the patched version to safeguard against potential exploits. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for python-pip →
FAQ
CRLF injection is a type of attack where an attacker can insert CR (Carriage Return) and LF (Line Feed) characters into HTTP headers, potentially leading to security issues.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability can lead to response splitting, cache poisoning, and other security breaches that could compromise user data and application integrity.
Yes, the patch is available in urllib3 version 1.25.9 and later. It is crucial to update to this version to mitigate the risk.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
