Описание
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
A flaw was found in Python. This vulnerability allows for the injection of extra information into HTTP communication. Specifically, the system does not properly prevent special characters (carriage return and line feed) from being included in HTTP client proxy tunnel headers or host fields.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | python | Fix deferred | ||
| Red Hat Enterprise Linux 7 | python | Fix deferred | ||
| Red Hat Enterprise Linux 7 | python3 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python3 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python3.11 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python36:3.6/python36 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python39-devel:3.9/python39 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | python3.11 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | python3.9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | redhat-user-workloads/bootc-cuda-aws-3-3 | Fix deferred |
Показывать по
10
Ссылки на источники
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-93
https://bugzilla.redhat.com/show_bug.cgi?id=2457409python: Python: HTTP header injection via CR/LF in proxy tunnel headers
EPSS
Процентиль: 43%
0.00562
Низкий
4.5 Medium
CVSS3
EPSS
Процентиль: 43%
0.00562
Низкий
4.5 Medium
CVSS3