CVE-2016-5699: Input Validation
A vulnerability in Python's http, ftp and url libraries was reported, allowing to inject additional HTTP headers and more.
Upstream bug: https://bugs.python.org/issue22928
Upstream patches Python 3.4 / 3.5 : revision 94952 : https://hg.python.org/cpython/rev/bf3e1c9b80e9 Python 2.7 : revision 94951 : https://hg.python.org/cpython/rev/1c45047c5102
Additional note : When used in combination with flaw described in BZ 1347549, an attacker could direct an HTTP connection to a malicious server, using the following combined issues:
Python's httplib does not validate HTTP header values. A malicious 'Host' header with quoted new lines can inject additional headers and more glibc's getaddrinfo() ignores new lines and everything after a new line character when the first part looks like a IPv4 address
See the following blog post for additional information: http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
Other sources
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
It was found that the Python's httplib library (used by urllib, urllib2 and others) did not properly check HTTPConnection.putheader() function arguments. An attacker could use this flaw to inject additional headers in a Python application that allowed user provided header names or values.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-5699?
CVE-2016-5699 has a medium severity level, allowing for the injection of additional HTTP headers in affected Python libraries.
How do I fix CVE-2016-5699?
To fix CVE-2016-5699, upgrade your Python package to a version that includes the upstream patches addressing this vulnerability.
Which versions of Python are affected by CVE-2016-5699?
CVE-2016-5699 affects multiple versions of Python, including versions prior to 2.7.9 and specific releases up to 3.5.1.
What libraries in Python does CVE-2016-5699 impact?
CVE-2016-5699 specifically impacts the http, ftp, and url libraries within Python.
Is there a specific package recommended for CVE-2016-5699 remediation?
Yes, updating to the specific recommended packages such as python-2.7.9 or later, python27-python-2.7.8-16.el7, or rh-python34-python-3.4.2-14.el6 is needed for remediation.