Home > Vulnerability Database > CVE-2016-5699

Mend.io Vulnerability Database

CVE-2016-5699

Date: September 2, 2016

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

Language: Python

Severity Score

6.1

Related Resources (25)

Url: https://nvd.nist.gov/vuln/detail/CVE-2016-5699

Url: http://rhn.redhat.com/errata/RHSA-2016-1629.html

Url: http://www.openwall.com/lists/oss-security/2016/06/16/2

Url: http://rhn.redhat.com/errata/RHSA-2016-1630.html

Url: https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html

Url: http://www.openwall.com/lists/oss-security/2016/06/15/12

Url: http://rhn.redhat.com/errata/RHSA-2016-1626.html

Url: http://www.splunk.com/view/SP-CAAAPSV

Url: https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS

Url: http://www.securityfocus.com/bid/91226

Url: https://bugs.python.org/issue22928

Url: http://rhn.redhat.com/errata/RHSA-2016-1628.html

Url: https://security-tracker.debian.org/tracker/CVE-2016-5699

Url: https://access.redhat.com/security/cve/CVE-2016-5699

Url: http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html

Url: https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4

Url: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

Url: http://www.splunk.com/view/SP-CAAAPUE

Url: https://hg.python.org/cpython/rev/1c45047c5102

Url: http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Url: http://rhn.redhat.com/errata/RHSA-2016-1627.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2016-5699

Url: http://www.openwall.com/lists/oss-security/2016/06/14/7

Url: https://hg.python.org/cpython/rev/bf3e1c9b80e9

Url: https://www.mend.io/vulnerability-database/CVE-2016-5699

Severity Score

6.1

Weakness Type (CWE)

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CWE-113

CVSS v3.1

Base Score:	6.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2016-5699

Date: September 2, 2016

Language: Python

Severity Score

Related Resources (25)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?