CVE-2020-26116

Name of the Vulnerable Software and Affected Versions Python versions 3.x before 3.5.10 Python versions 3.6.x before 3.6.12 Python versions 3.7.x before 3.7.9 Python versions 3.8.x before 3.8.5

Description The issue is related to a lack of output encoding or escaping mechanism in Python's HTTP request method. This can be exploited by a remote attacker to gain access to confidential data and compromise its integrity. The vulnerability can be exploited if the attacker controls the HTTP request method, for example, by inserting CR and LF control characters in the first argument of HTTPConnection.request().

Recommendations For Python versions 3.x before 3.5.10, update to version 3.5.10 or later. For Python versions 3.6.x before 3.6.12, update to version 3.6.12 or later. For Python versions 3.7.x before 3.7.9, update to version 3.7.9 or later. For Python versions 3.8.x before 3.8.5, update to version 3.8.5 or later.