Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 530
Alerts This Week
Warning Icon 1 530

SUSE: 2021:0515-1 Moderate: Fix for Python-Urllib3 CRLF Injection

suse
Calendar Grey February 18, 2021
Dist Suse Esm H88
SUSE Security Update for python-requests addresses a vulnerability related to improper input handling that could lead to content injection in network requests. Find out more inside.
An update that fixes one vulnerability is now available

Summary

This update for python-urllib3 fixes the following issues: - CVE-2020-26116: Raise ValueError if method contains control characters and thus prevent CRLF injection into URLs (bsc#1177211). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2021-515=1 - SUSE OpenStack Cloud 8: zypper in -t patch SUSE-OpenStack-Cloud-8-2021-515=1 - HPE Helion Openstack 8: zypper in -t patch HPE-Helion-OpenStack-8-2021-515=1 Package List: - SUSE OpenStack Cloud Crowbar 8 (noarch): python-urllib3-1.22-5.15.1 - SUSE OpenStack Cloud 8 (noarch): python-urllib3-1.22-5.15.1

Topics%20covered

Topics Covered

security advisory moderate security update suse crlf injection python-urllib3

References

#1177211

Cross- CVE-2020-26116

CVSS scores:

CVE-2020-26116 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CVE-2020-26116 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Affected Products:

SUSE OpenStack Cloud Crowbar 8

SUSE OpenStack Cloud 8

HPE Helion Openstack 8

https://www.suse.com/security/cve/CVE-2020-26116.html

https://bugzilla.suse.com/1177211

Announcement ID: SUSE-SU-2021:0515-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate security update suse crlf injection python-urllib3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.