Fix CVE-2020-26116: Reject control chars in HTTP method in httplib

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - http.client in Python 3.x before 3.5.10, 3.6.x before     3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP     request method, as demonstrated by inserting CR and LF     control characters in the first argument of     HTTPConnection.request.(CVE-2020-26116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - http.client in Python 3.x before 3.5.10, 3.6.x before     3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP     request method, as demonstrated by inserting CR and LF     control characters in the first argument of     HTTPConnection.request.(CVE-2020-26116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - http.client in Python 3.x before 3.5.10, 3.6.x before     3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP     request method, as demonstrated by inserting CR and LF     control characters in the first argument of     HTTPConnection.request.(CVE-2020-26116)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker     is able to craft a TAR archive leading to an infinite     loop when opened by tarfile.open, because _proc_pax     lacks header validation.(CVE-2019-20907)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 fixes the following issues :

  - Fixed CVE-2020-27619 (bsc#1178009), where     Lib/test/multibytecodec_support calls eval() on content     retrieved via HTTP.

  - Change setuptools and pip version numbers according to     new wheels

  - Handful of changes to make python36 compatible with     SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738)

  - add triplets for mips-r6 and riscv

  - RISC-V needs CTYPES_PASS_BY_REF_HACK

Update to 3.6.12 (bsc#1179193)

  - Ensure python3.dll is loaded from correct locations when     Python is embedded

  - The __hash__() methods of ipaddress.IPv4Interface and     ipaddress.IPv6Interface incorrectly generated constant     hash values of 32 and 128 respectively. This resulted in     always causing hash collisions. The fix uses hash() to     generate hash values for the tuple of (address, mask     length, network address).

  - Prevent http header injection by rejecting control     characters in http.client.putrequest(&hellip;).

  - Unpickling invalid NEWOBJ_EX opcode with the C     implementation raises now UnpicklingError instead of     crashing.

  - Avoid infinite loop when reading specially crafted TAR     files using the tarfile module

  - This release also fixes CVE-2020-26116 (bsc#1177211) and     CVE-2019-20907 (bsc#1174091).

Update to 3.6.11 :

  - Disallow CR or LF in email.headerregistry. Address     arguments to guard against header injection attacks.

  - Disallow control characters in hostnames in http.client,     addressing CVE-2019-18348. Such potentially malicious     header injection URLs now cause a InvalidURL to be     raised. (bsc#1155094)

  - CVE-2020-8492: The AbstractBasicAuthHandler class of the     urllib.request module uses an inefficient regular     expression which can be exploited by an attacker to     cause a denial of service. Fix the regex to prevent the     catastrophic backtracking. Vulnerability reported by Ben     Caller and Matt Schwager.

This update was imported from the SUSE:SLE-15:Update update project.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3610 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3610-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     October 08, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-urllib3     Version        : 1.24.1-1+deb10u1     CVE ID         : CVE-2019-11236 CVE-2019-11324 CVE-2020-26137 CVE-2023-43804     Debian Bug     : 927172 927412 1053626

    Security vulnerabilities were found in python-urllib3, an HTTP library     with thread-safe connection pooling for Python, which could lead to     information disclosure or authorization bypass.

    CVE-2019-11236

        Hanno Bck discovered that an attacker controlling the request         parameter can inject headers by injecting CR/LF chars.  The issue is         similar to CPython's CVE-2019-9740.

    CVE-2019-11324

        Christian Heimes discovered that when verifying HTTPS connections         upon passing an SSLContext to urllib3, system CA certificates are         loaded into the SSLContext by default in addition to any         manually-specified CA certificates.
        This causes TLS handshakes that should fail given only the manually         specified certs to succeed based on system CA certs.

    CVE-2020-26137

        It was discovered that CRLF injection was possible if the attacker         controls the HTTP request method, as demonstrated by inserting CR         and LF control characters in the first argument of putrequest().
        The issue is similar to urllib's CVE-2020-26116.

    CVE-2023-43804

        It was discovered that the Cookie request header isn't stripped         during cross-origin redirects.  It is therefore possible for a user         specifying a Cookie header to unknowingly leak information via HTTP         redirects to a different origin (unless the user disables redirects         explicitly).  The issue is similar to CVE-2018-20060, but for Cookie         request header rather than Authorization.

        Moreover authorization request headers were not removed         redirecting to cross-site.  Per RFC7230 sec. 3.2 header fields are         to be treated case-insensitively.

    For Debian 10 buster, these problems have been fixed in version     1.24.1-1+deb10u1.

    We recommend that you upgrade your python-urllib3 packages.

    For the detailed security status of python-urllib3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-urllib3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1761 advisory.

  - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

  - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as     demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this     is similar to CVE-2020-26116. (CVE-2020-26137)

  - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary HTML/JS code. (CVE-2020-27783)

  - Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to     remote code execution in certain Python applications that accept floating-point numbers as untrusted     input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used     unsafely. (CVE-2021-3177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1633 advisory.

  - python: CRLF injection via HTTP request method in httplib/http.client (CVE-2020-26116)

  - python: Unsafe use of eval() on data retrieved via HTTP in the test suite (CVE-2020-27619)

  - python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in     query parameters (CVE-2021-23336)

  - python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c (CVE-2021-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
142104	Fedora 31 : python2 (2020-e33acdea18)	Nessus	Fedora Local Security Checks	10/30/2020	2/13/2024	high
142161	EulerOS 2.0 SP8 : python2 (EulerOS-SA-2020-2317)	Nessus	Huawei Local Security Checks	11/2/2020	2/13/2024	high
142243	EulerOS 2.0 SP9 : python3 (EulerOS-SA-2020-2437)	Nessus	Huawei Local Security Checks	11/3/2020	2/12/2024	high
142308	EulerOS 2.0 SP2 : python (EulerOS-SA-2020-2388)	Nessus	Huawei Local Security Checks	11/3/2020	2/12/2024	high
145389	openSUSE Security Update : python3 (openSUSE-2020-2333)	Nessus	SuSE Local Security Checks	1/25/2021	1/26/2024	critical
182762	Debian dla-3610 : python-urllib3 - security update	Nessus	Debian Local Security Checks	10/8/2023	1/22/2025	critical
184838	Rocky Linux 8 : python27:2.7 (RLSA-2021:1761)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	critical
149729	CentOS 8 : python3 (CESA-2021:1633)	Nessus	CentOS Local Security Checks	5/19/2021	1/1/2024	critical

Detections

Analytics

Plugins Search

high

high

high

high

critical

critical

critical

critical