CVE-2016-5699

medium · 6.1

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

6.1

CVSS

15.7%

EPSS (exploit prob.)

97th

EPSS percentile

2016-09-02

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-113

Affected products

Vendor	Product	Affected versions
python	python	<= 2.7.9
python	python	3.0
python	python	3.0.1
python	python	3.1.0
python	python	3.1.1
python	python	3.1.2
python	python	3.1.3
python	python	3.1.4
python	python	3.1.5
python	python	3.2.0
python	python	3.2.1
python	python	3.2.2
python	python	3.2.3
python	python	3.2.4
python	python	3.2.5
python	python	3.2.6
python	python	3.3.0
python	python	3.3.1
python	python	3.3.2
python	python	3.3.3
python	python	3.3.4
python	python	3.3.5
python	python	3.3.6
python	python	3.4.0
python	python	3.4.1
python	python	3.4.2
python	python	3.4.3

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-5699