Python up to 3.5.9/3.6.11/3.7.8/3.8.4 http.client Control Character privileges management

Summaryinfo

A vulnerability described as critical has been identified in Python up to 3.5.9/3.6.11/3.7.8/3.8.4. This issue affects some unknown processing of the component http.client. Executing a manipulation as part of Control Character can lead to privileges management. The identification of this vulnerability is CVE-2020-26116. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Python up to 3.5.9/3.6.11/3.7.8/3.8.4 (Programming Language Software). It has been declared as critical. This vulnerability affects an unknown code block of the component http.client. The manipulation as part of a Control Character leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

The weakness was shared 09/27/2020. This vulnerability was named CVE-2020-26116 since 09/27/2020. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 236633 (Alibaba Cloud Linux 3 : 0112: python27:2.7 (ALINUX3-SA-2022:0112)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.5.10, 3.6.12, 3.7.9 or 3.8.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236633). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Name

• Python

Version

• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.5.9
• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4
• 3.6.5
• 3.6.6
• 3.6.7
• 3.6.8
• 3.6.9
• 3.6.10
• 3.6.11
• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7
• 3.7.8
• 3.8.0
• 3.8.1
• 3.8.2
• 3.8.3
• 3.8.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion