CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade python | Aug 30, 2017 | Sep 2, 2016 |
| Amazon_linux | — | Upgrade python27Upgrade python26Upgrade python34 | Jul 22, 2016 | Jul 20, 2016 |
| Centos_linux | — | Upgrade pythonUpgrade tkinterUpgrade python-libsUpgrade python-testUpgrade python-toolsUpgrade python-develUpgrade python-debug | Aug 22, 2016 | Aug 18, 2016 |
| Debian | — | Upgrade python2.7 | Mar 31, 2017 | Jun 21, 2016 |
| Freebsd | — | Upgrade python27Upgrade python34Upgrade python35Upgrade python33 | Dec 10, 2025 | Jun 30, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade pythonUpgrade python-libsUpgrade python-devel | Nov 30, 2017 | Sep 2, 2016 |
| Oracle Solaris | — | Upgrade runtime/python-27 to version 2.7.9-0.175.3.10.0.3.0 on Solaris 11.3Upgrade runtime/python-27/tests to version 2.7.9-0.175.3.10.0.3.0 on Solaris 11.3Upgrade library/python/tkinter-27 to version 2.7.9-0.175.3.10.0.3.0 on Solaris 11.3Upgrade runtime/python-34 to version 3.4.3-0.175.3.10.0.3.0 on Solaris 11.3Upgrade library/python/tkinter-34 to version 3.4.3-0.175.3.10.0.3.0 on Solaris 11.3 | May 29, 2017 | Sep 2, 2016 |
| Oracle_linux | — | Upgrade python-libsUpgrade python-develUpgrade tkinterUpgrade python-testUpgrade python-toolsUpgrade pythonUpgrade python-debug | Sep 2, 2016 | Nov 24, 2014 |
| Redhat_linux | — | Upgrade python-develUpgrade python-toolsUpgrade python-debuginfoUpgrade python-debugUpgrade python-libsUpgrade python-testNo solution existsUpgrade pythonUpgrade tkinter | Aug 22, 2016 | Aug 18, 2016 |
| Suse | — | Upgrade libpython3_6m1_0Upgrade python-xmlUpgrade python3-32bitUpgrade python3-tkUpgrade python-cursesUpgrade libpython3_6m1_0-32bitUpgrade libpython3_4m1_0Upgrade python3-baseUpgrade python-docUpgrade libpython2_7-1_0Upgrade python3-testsuiteUpgrade python-idleUpgrade python3-dbmUpgrade python-base-x86Upgrade libpython2_7-1_0-32bitUpgrade python3-base-32bitUpgrade python3-develUpgrade python-32bitUpgrade python3Upgrade python3-cursesUpgrade python3-idleUpgrade python-demoUpgrade libpython2_6-1_0-32bitUpgrade libpython2_6-1_0Upgrade python3-toolsUpgrade python-tkUpgrade python-base-32bitUpgrade python-x86Upgrade python-baseUpgrade python-develUpgrade python-gdbmUpgrade libpython3_4m1_0-32bitUpgrade libpython2_6-1_0-x86Upgrade pythonUpgrade python-doc-pdf | Sep 2, 2016 | Sep 2, 2016 |
| Ubuntu | — | Upgrade libpython3.5-stdlibUpgrade python3.2Upgrade libpython3.5Upgrade libpython2.7Upgrade python3.5-minimalUpgrade libpython3.4-minimalUpgrade python3.5Upgrade libpython2.7-stdlibUpgrade python3.2-minimalUpgrade libpython3.4Upgrade python3.4-minimalUpgrade libpython3.4-stdlibUpgrade libpython2.7-minimalUpgrade python3.4Upgrade python2.7-minimalUpgrade libpython3.5-minimalUpgrade python2.7Upgrade libpython3.2 | Nov 23, 2016 | Sep 2, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub