CRLF Injection Vulnerability in Python 3.x Packages
Summary
UBUNTU-CVE-2020-26116: http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF cont... Affects python3.4 versions < 3.4.3-1ubuntu1~14.04.7+esm8. Fixed in 3.4.3-1ubuntu1~14.04.7+esm8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The affected packages, including python3.4, python3.5, python3.6, python3.7, and python3.8, are essential components for running Python applications. These packages provide the Python interpreter and standard libraries, enabling developers to create a wide range of applications. The vulnerability in question affects the http.client module, which is responsible for handling HTTP requests, making it critical for web-based applications.
Vulnerability Detail
The vulnerability, identified as CVE-2020-26116, allows for CRLF (Carriage Return Line Feed) injection in Python 3.x versions prior to 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5. This issue arises when an attacker can control the HTTP request method, enabling them to insert CR and LF control characters in the first argument of the HTTPConnection.request method. This could lead to various attacks, including HTTP response splitting, which can compromise the integrity and confidentiality of the application.
How To Fix
Minimum fixed version
3.4.3-1ubuntu1~14.04.7+esm8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user input is sanitized and validated before being passed to the HTTPConnection.request method. This can help mitigate the risk of CRLF injection. Additionally, consider using a more secure method for handling HTTP requests, such as using higher-level libraries that abstract away direct HTTP handling.
Conclusion
The CRLF injection vulnerability in Python 3.x packages poses a significant risk to applications that rely on these versions. It is crucial to update to the patched versions to safeguard against potential attacks. Additionally, implementing input validation can serve as a temporary measure until updates can be applied.
See every vulnerability recorded for python3.4 →
FAQ
CRLF injection is a type of attack that allows an attacker to insert Carriage Return (CR) and Line Feed (LF) characters into HTTP headers, potentially leading to HTTP response splitting and other security issues.
The affected versions include Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If exploited, this vulnerability can lead to HTTP response splitting, allowing attackers to manipulate responses, steal sensitive information, or perform further attacks on users.
Yes, you can sanitize and validate user inputs before passing them to HTTP requests to reduce the risk of CRLF injection.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
