Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-26137: A flaw was found in python-urllib3. The HTTPConnection.request() does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity. 1883632: CVE-2020-26137 python-urllib3: CRLF injection via HTTP request method
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python-urllib3 | 0:1.25.9-1.amzn2.0.1 |
Vulnerabilities 1
-
Medium 6.5
CRLF injection in urllib3
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-26137.html