CVE-2016-5699 Other in n/a
Remote attackers can inject arbitrary HTTP headers via CRLF sequences in URLs using Python's urllib, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-5699?
CVE-2016-5699 is a medium-severity vulnerability in Python Python, published on 2 Sep 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
Weakness: CWE-113
Which versions are affected by CVE-2016-5699?
It affects 1 product.
Products include Python Python.
How do I fix CVE-2016-5699?
Upgrade to a fixed version.
Is CVE-2016-5699 being exploited?
There is no known exploitation of CVE-2016-5699 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Python Python
Sources
Also known as AZL-109611, DEBIAN-CVE-2016-5699, GHSA-mfrc-633m-gcwg, PSF-2016-8, UBUNTU-CVE-2016-5699.