CVE-2016-5699

Published: Sep 2, 2016Modified: May 6, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

Affected (27)

Products: Python: Python

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Python	Up to 2.7.9

Configuration B

26 vulnerable

Vulnerable Software	Affected Versions
Python Python	Version 3.0.1
Python Python	Version 3.0
Python Python	Version 3.1.0
Python Python	Version 3.1.1
Python Python	Version 3.1.2
Python Python	Version 3.1.3
Python Python	Version 3.1.4
Python Python	Version 3.1.5
Python Python	Version 3.2.0
Python Python	Version 3.2.1
Python Python	Version 3.2.2
Python Python	Version 3.2.3
Python Python	Version 3.2.4
Python Python	Version 3.2.5
Python Python	Version 3.2.6
Python Python	Version 3.3.0
Python Python	Version 3.3.1
Python Python	Version 3.3.2
Python Python	Version 3.3.3
Python Python	Version 3.3.4
Python Python	Version 3.3.5
Python Python	Version 3.3.6
Python Python	Version 3.4.0
Python Python	Version 3.4.1
Python Python	Version 3.4.2
Python Python	Version 3.4.3

Related CWEs

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

References (38)

http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html

Source: secalert@redhat.com

ExploitThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1626.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1627.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1628.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1629.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1630.html

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/06/14/7

Source: secalert@redhat.com

Mailing List

http://www.openwall.com/lists/oss-security/2016/06/15/12

Source: secalert@redhat.com

Mailing List

http://www.openwall.com/lists/oss-security/2016/06/16/2

Source: secalert@redhat.com

Mailing List

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91226

Source: secalert@redhat.com

http://www.splunk.com/view/SP-CAAAPSV

Source: secalert@redhat.com

http://www.splunk.com/view/SP-CAAAPUE

Source: secalert@redhat.com

https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4

Source: secalert@redhat.com

Release Notes

https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS

Source: secalert@redhat.com

Release Notes

https://hg.python.org/cpython/rev/1c45047c5102

Source: secalert@redhat.com

Patch

https://hg.python.org/cpython/rev/bf3e1c9b80e9

Source: secalert@redhat.com

Patch

https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html

Source: secalert@redhat.com

http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-1626.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-1627.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-1628.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-1629.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-1630.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2016/06/14/7

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.openwall.com/lists/oss-security/2016/06/15/12

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.openwall.com/lists/oss-security/2016/06/16/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/91226

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.splunk.com/view/SP-CAAAPSV

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.splunk.com/view/SP-CAAAPUE

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://hg.python.org/cpython/rev/1c45047c5102

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://hg.python.org/cpython/rev/bf3e1c9b80e9

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.