Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-26116: A flaw was found in Python. The built-in modules httplib and http.client (included in Python 2 and Python 3, respectively) do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity. 1883014: CVE-2020-26116 python: CRLF injection via HTTP request method in httplib/http.client
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python | 0:2.7.18-1.amzn2.0.4 |
| Amazon Linux · 2 | python-debug | 0:2.7.18-1.amzn2.0.4 |
| Amazon Linux · 2 | python-debuginfo | 0:2.7.18-1.amzn2.0.4 |
| Amazon Linux · 2 | python-devel | 0:2.7.18-1.amzn2.0.4 |
| Amazon Linux · 2 | python-libs | 0:2.7.18-1.amzn2.0.4 |
| Amazon Linux · 2 | python-test | 0:2.7.18-1.amzn2.0.4 |
| Amazon Linux · 2 | python-tools | 0:2.7.18-1.amzn2.0.4 |
| Amazon Linux · 2 | tkinter | 0:2.7.18-1.amzn2.0.4 |
Vulnerabilities 1
-
Unscored —
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-26116.html