PT-2020-6266
CVE-2020-26116
·
تاريخ النشر
2020-02-10
·
تاريخ التحديث
2026-10-14
الوصف من
CVSS 3.1
7.2
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Python versions 3.x before 3.5.10
Python versions 3.6.x before 3.6.12
Python versions 3.7.x before 3.7.9
Python versions 3.8.x before 3.8.5
Description
The issue is related to a lack of output encoding or escaping mechanism in Python's HTTP request method. This can be exploited by a remote attacker to gain access to confidential data and compromise its integrity. The vulnerability can be exploited if the attacker controls the HTTP request method, for example, by inserting CR and LF control characters in the first argument of
HTTPConnection.request().Recommendations
For Python versions 3.x before 3.5.10, update to version 3.5.10 or later.
For Python versions 3.6.x before 3.6.12, update to version 3.6.12 or later.
For Python versions 3.7.x before 3.7.9, update to version 3.7.9 or later.
For Python versions 3.8.x before 3.8.5, update to version 3.8.5 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾