CVE-2020-26137 @ Python-urllib3-1.21.1

[cx-pedro-lopes]

Vulnerable Package issue exists @ Python-urllib3-1.21.1 in branch main

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Namespace: pedrompflopes
Repository: small-project
Repository Url: https://github.com/pedrompflopes/small-project
CxAST-Project: pedrompflopes/small-project
CxAST platform scan: c8ffe959-aafe-486d-a7e7-1ba92f6aee49
Branch: main
Application: small-project
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
CWE: CWE-74

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: 1.26.5

---

References
Issue
Pull request
Commit
Advisory