ID CVE-2016-5699
Summary CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
References
Vulnerable Configurations
  • cpe:2.3:a:python:python:-:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:-:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:0.9.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:0.9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:0.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:0.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:1.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:1.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:1.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:1.6:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:1.6:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:1.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:1.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.3.7:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.3.7:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.4:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.5:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.5.6:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.5.150:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.5.150:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.7:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.8:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.9:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.9:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.2150:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.2150:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.6.6150:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.6.6150:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.1:-:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.1:-:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.1:rc1:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.1:rc1:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.2:-:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.2:-:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.2:rc1:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.2:rc1:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.3:-:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.3:-:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.3:rc1:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.3:rc1:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.3:rc2:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.3:rc2:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.4:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.4:-:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.4:-:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.4:rc1:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.4:rc1:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.6:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.6:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.6:-:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.6:-:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.6:rc1:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.6:rc1:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.7:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.7:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.7:-:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.7:-:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.7:rc1:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.7:rc1:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.8:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.8:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.9:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.9:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.9:-:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.9:-:*:*:*:*:*:*
  • cpe:2.3:a:python:python:2.7.9:rc1:*:*:*:*:*:*
    cpe:2.3:a:python:python:2.7.9:rc1:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:python:python:3.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:python:python:3.4.3:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 09-02-2019 - 11:29)
Impact:
Exploitability:
CWE CWE-113
CAPEC
  • HTTP Response Splitting
    This attack uses a maliciously-crafted HTTP request in order to cause a vulnerable web server to respond with an HTTP response stream that will be interpreted by the client as two separate responses instead of one. This is possible when user-controlled input is used unvalidated as part of the response headers. The target software, the client, will interpret the injected header as being a response to a second request, thereby causing the maliciously-crafted contents be displayed and possibly cached.
  • Accessing/Intercepting/Modifying HTTP Cookies
    This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.
  • AJAX Fingerprinting
    This attack utilizes the frequent client-server roundtrips in Ajax conversation to scan a system. While Ajax does not open up new vulnerabilities per se, it does optimize them from an attacker point of view. In many XSS attacks the attacker must get a "hole in one" and successfully exploit the vulnerability on the victim side the first time, once the client is redirected the attacker has many chances to engage in follow on probes, but there is only one first chance. In a widely used web application this is not a major problem because 1 in a 1,000 is good enough in a widely used application. A common first step for an attacker is to footprint the environment to understand what attacks will work. Since footprinting relies on enumeration, the conversational pattern of rapid, multiple requests and responses that are typical in Ajax applications enable an attacker to look for many vulnerabilities, well-known ports, network locations and so on.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:P/A:N
redhat via4
advisories
  • bugzilla
    id 1365200
    title Upstream tests cause building python package on brew stall and leave orphan processes that need manually kill
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment python is earlier than 0:2.7.5-38.el7_2
            oval oval:com.redhat.rhsa:tst:20161626001
          • comment python is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554004
        • AND
          • comment python-debug is earlier than 0:2.7.5-38.el7_2
            oval oval:com.redhat.rhsa:tst:20161626003
          • comment python-debug is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20152101004
        • AND
          • comment python-devel is earlier than 0:2.7.5-38.el7_2
            oval oval:com.redhat.rhsa:tst:20161626005
          • comment python-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554006
        • AND
          • comment python-libs is earlier than 0:2.7.5-38.el7_2
            oval oval:com.redhat.rhsa:tst:20161626007
          • comment python-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554008
        • AND
          • comment python-test is earlier than 0:2.7.5-38.el7_2
            oval oval:com.redhat.rhsa:tst:20161626009
          • comment python-test is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554010
        • AND
          • comment python-tools is earlier than 0:2.7.5-38.el7_2
            oval oval:com.redhat.rhsa:tst:20161626011
          • comment python-tools is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554012
        • AND
          • comment tkinter is earlier than 0:2.7.5-38.el7_2
            oval oval:com.redhat.rhsa:tst:20161626013
          • comment tkinter is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554014
    • AND
      • comment Red Hat Enterprise Linux 6 is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • comment python is earlier than 0:2.6.6-66.el6_8
            oval oval:com.redhat.rhsa:tst:20161626016
          • comment python is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554004
        • AND
          • comment python-devel is earlier than 0:2.6.6-66.el6_8
            oval oval:com.redhat.rhsa:tst:20161626017
          • comment python-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554006
        • AND
          • comment python-libs is earlier than 0:2.6.6-66.el6_8
            oval oval:com.redhat.rhsa:tst:20161626018
          • comment python-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554008
        • AND
          • comment python-test is earlier than 0:2.6.6-66.el6_8
            oval oval:com.redhat.rhsa:tst:20161626019
          • comment python-test is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554010
        • AND
          • comment python-tools is earlier than 0:2.6.6-66.el6_8
            oval oval:com.redhat.rhsa:tst:20161626020
          • comment python-tools is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554012
        • AND
          • comment tkinter is earlier than 0:2.6.6-66.el6_8
            oval oval:com.redhat.rhsa:tst:20161626021
          • comment tkinter is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110554014
    rhsa
    id RHSA-2016:1626
    released 2016-08-18
    severity Moderate
    title RHSA-2016:1626: python security update (Moderate)
  • rhsa
    id RHSA-2016:1627
  • rhsa
    id RHSA-2016:1628
  • rhsa
    id RHSA-2016:1629
  • rhsa
    id RHSA-2016:1630
rpms
  • python-0:2.6.6-66.el6_8
  • python-0:2.7.5-38.el7_2
  • python-debug-0:2.7.5-38.el7_2
  • python-debuginfo-0:2.6.6-66.el6_8
  • python-debuginfo-0:2.7.5-38.el7_2
  • python-devel-0:2.6.6-66.el6_8
  • python-devel-0:2.7.5-38.el7_2
  • python-libs-0:2.6.6-66.el6_8
  • python-libs-0:2.7.5-38.el7_2
  • python-test-0:2.6.6-66.el6_8
  • python-test-0:2.7.5-38.el7_2
  • python-tools-0:2.6.6-66.el6_8
  • python-tools-0:2.7.5-38.el7_2
  • tkinter-0:2.6.6-66.el6_8
  • tkinter-0:2.7.5-38.el7_2
  • rh-python35-python-0:3.5.1-9.el7
  • rh-python35-python-debug-0:3.5.1-9.el7
  • rh-python35-python-debuginfo-0:3.5.1-9.el7
  • rh-python35-python-devel-0:3.5.1-9.el7
  • rh-python35-python-libs-0:3.5.1-9.el7
  • rh-python35-python-test-0:3.5.1-9.el7
  • rh-python35-python-tkinter-0:3.5.1-9.el7
  • rh-python35-python-tools-0:3.5.1-9.el7
  • python27-python-0:2.7.8-16.el7
  • python27-python-0:2.7.8-18.el6
  • python27-python-debug-0:2.7.8-16.el7
  • python27-python-debug-0:2.7.8-18.el6
  • python27-python-debuginfo-0:2.7.8-16.el7
  • python27-python-debuginfo-0:2.7.8-18.el6
  • python27-python-devel-0:2.7.8-16.el7
  • python27-python-devel-0:2.7.8-18.el6
  • python27-python-libs-0:2.7.8-16.el7
  • python27-python-libs-0:2.7.8-18.el6
  • python27-python-test-0:2.7.8-16.el7
  • python27-python-test-0:2.7.8-18.el6
  • python27-python-tools-0:2.7.8-16.el7
  • python27-python-tools-0:2.7.8-18.el6
  • python27-tkinter-0:2.7.8-16.el7
  • python27-tkinter-0:2.7.8-18.el6
  • python33-python-0:3.3.2-16.el7
  • python33-python-0:3.3.2-18.el6
  • python33-python-debug-0:3.3.2-16.el7
  • python33-python-debug-0:3.3.2-18.el6
  • python33-python-debuginfo-0:3.3.2-16.el7
  • python33-python-debuginfo-0:3.3.2-18.el6
  • python33-python-devel-0:3.3.2-16.el7
  • python33-python-devel-0:3.3.2-18.el6
  • python33-python-libs-0:3.3.2-16.el7
  • python33-python-libs-0:3.3.2-18.el6
  • python33-python-test-0:3.3.2-16.el7
  • python33-python-test-0:3.3.2-18.el6
  • python33-python-tkinter-0:3.3.2-16.el7
  • python33-python-tkinter-0:3.3.2-18.el6
  • python33-python-tools-0:3.3.2-16.el7
  • python33-python-tools-0:3.3.2-18.el6
  • rh-python34-python-0:3.4.2-13.el7
  • rh-python34-python-0:3.4.2-14.el6
  • rh-python34-python-debug-0:3.4.2-13.el7
  • rh-python34-python-debug-0:3.4.2-14.el6
  • rh-python34-python-debuginfo-0:3.4.2-13.el7
  • rh-python34-python-debuginfo-0:3.4.2-14.el6
  • rh-python34-python-devel-0:3.4.2-13.el7
  • rh-python34-python-devel-0:3.4.2-14.el6
  • rh-python34-python-libs-0:3.4.2-13.el7
  • rh-python34-python-libs-0:3.4.2-14.el6
  • rh-python34-python-test-0:3.4.2-13.el7
  • rh-python34-python-test-0:3.4.2-14.el6
  • rh-python34-python-tkinter-0:3.4.2-13.el7
  • rh-python34-python-tkinter-0:3.4.2-14.el6
  • rh-python34-python-tools-0:3.4.2-13.el7
  • rh-python34-python-tools-0:3.4.2-14.el6
refmap via4
bid 91226
confirm
misc http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
mlist
  • [debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update
  • [oss-security] 20160614 CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
  • [oss-security] 20160615 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
  • [oss-security] 20160616 Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
suse openSUSE-SU-2020:0086
Last major update 09-02-2019 - 11:29
Published 02-09-2016 - 14:59
Last modified 09-02-2019 - 11:29
Back to Top