F5-K000133759: CRLF Injection
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.4Fixed in 1.5.4-Fixed in 1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.4-Fixed in 1
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker must be able to control the HTTP request method passed as the first argument to HTTPConnection.request and include carriage-return and line-feed control characters in that value.
Which Python releases contain the vulnerable http.client behavior?
Affected releases are Python 3.x before 3.5.10, Python 3.6 before 3.6.12, Python 3.7 before 3.7.9, and Python 3.8 before 3.8.5.
Does exploitation require authentication or user interaction?
No. The supplied vector identifies network-based exploitation with low attack complexity and no required privileges or user interaction.