User-controlled header names and values containing newlines can allow injecting HTTP headers.
Weakness
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | RedHat | python3.12-0:3.12.12-3.el10_1.1 | * |
| Red Hat Enterprise Linux 10 | RedHat | python3.14-0:3.14.4-2.el10_2 | * |
| Red Hat Enterprise Linux 8 | RedHat | python3-0:3.6.8-73.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | python3.12-0:3.12.12-3.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | python3.11-0:3.11.13-5.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | python3-0:3.6.8-73.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.9-0:3.9.25-5.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.11-0:3.11.13-7.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.12-0:3.12.12-6.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.14-0:3.14.4-2.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.9-0:3.9.25-3.el9_7.1 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.9-0:3.9.25-5.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.9-0:3.9.25-3.el9_7.1 | * |
| Red Hat Enterprise Linux 9.4 Extended Update Support | RedHat | python3.11-0:3.11.7-1.el9_4.11 | * |
| Red Hat Ceph Storage 8 | RedHat | rhceph/rhceph-8-rhel9:1774002867 | * |
| Red Hat Hardened Images | RedHat | python3-13-main-3.13.13-1.hum1 | * |
| Red Hat Hardened Images | RedHat | python3-14-main-3.14.4-1.hum1 | * |
| Red Hat Hardened Images | RedHat | python3-11-main-3.11.15-4.hum1 | * |
| Red Hat Hardened Images | RedHat | python3-12-main-3.12.13-3.hum1 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-rhel9:1779798159 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/haproxy-rhel9:1779798164 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/installer-rhel9:1779798165 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/rhua-rhel9:1779798222 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-rhel9:1773670073 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/haproxy-rhel9:1773672059 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/installer-rhel9:1773668803 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/rhua-rhel9:1773670137 | * |
| Python2.7 | Ubuntu | esm-apps/focal | * |
| Python2.7 | Ubuntu | esm-apps/jammy | * |
| Python2.7 | Ubuntu | esm-infra-legacy/trusty | * |
| Python2.7 | Ubuntu | esm-infra-legacy/xenial | * |
| Python2.7 | Ubuntu | esm-infra/bionic | * |
| Python2.7 | Ubuntu | esm-infra/xenial | * |
| Python2.7 | Ubuntu | jammy | * |
| Python3.10 | Ubuntu | jammy | * |
| Python3.11 | Ubuntu | esm-apps/jammy | * |
| Python3.11 | Ubuntu | jammy | * |
| Python3.12 | Ubuntu | noble | * |
| Python3.13 | Ubuntu | questing | * |
| Python3.13 | Ubuntu | upstream | * |
| Python3.14 | Ubuntu | questing | * |
| Python3.4 | Ubuntu | esm-infra-legacy/trusty | * |
| Python3.5 | Ubuntu | esm-infra-legacy/trusty | * |
| Python3.5 | Ubuntu | esm-infra-legacy/xenial | * |
| Python3.5 | Ubuntu | esm-infra/xenial | * |
| Python3.6 | Ubuntu | esm-infra/bionic | * |
| Python3.7 | Ubuntu | esm-apps/bionic | * |
| Python3.8 | Ubuntu | esm-apps/bionic | * |
| Python3.8 | Ubuntu | esm-infra/focal | * |
| Python3.9 | Ubuntu | esm-apps/focal | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/10.html
- https://cwe.mitre.org/data/definitions/101.html
- https://cwe.mitre.org/data/definitions/105.html
- https://cwe.mitre.org/data/definitions/108.html
- https://cwe.mitre.org/data/definitions/120.html
- https://cwe.mitre.org/data/definitions/13.html
- https://cwe.mitre.org/data/definitions/135.html
- https://cwe.mitre.org/data/definitions/14.html
- https://cwe.mitre.org/data/definitions/24.html
- https://cwe.mitre.org/data/definitions/250.html
- https://cwe.mitre.org/data/definitions/267.html
- https://cwe.mitre.org/data/definitions/273.html
- https://cwe.mitre.org/data/definitions/28.html
- https://cwe.mitre.org/data/definitions/3.html
- https://cwe.mitre.org/data/definitions/34.html
- https://cwe.mitre.org/data/definitions/42.html
- https://cwe.mitre.org/data/definitions/43.html
- https://cwe.mitre.org/data/definitions/45.html
- https://cwe.mitre.org/data/definitions/46.html
- https://cwe.mitre.org/data/definitions/47.html
- https://cwe.mitre.org/data/definitions/51.html
- https://cwe.mitre.org/data/definitions/52.html
- https://cwe.mitre.org/data/definitions/53.html
- https://cwe.mitre.org/data/definitions/6.html
- https://cwe.mitre.org/data/definitions/64.html
- https://cwe.mitre.org/data/definitions/67.html
- https://cwe.mitre.org/data/definitions/7.html
- https://cwe.mitre.org/data/definitions/71.html
- https://cwe.mitre.org/data/definitions/72.html
- https://cwe.mitre.org/data/definitions/76.html
- https://cwe.mitre.org/data/definitions/78.html
- https://cwe.mitre.org/data/definitions/79.html
- https://cwe.mitre.org/data/definitions/8.html
- https://cwe.mitre.org/data/definitions/80.html
- https://cwe.mitre.org/data/definitions/83.html
- https://cwe.mitre.org/data/definitions/84.html
- https://cwe.mitre.org/data/definitions/9.html
References
- https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee58
- https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c510
- https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5f
- https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2
- https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c5
- https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a6
- https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9fff
- https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a97
- https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04cf
- https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb219
- https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a6995
- https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da7211
- https://github.com/python/cpython/issues/143916
- https://github.com/python/cpython/pull/143917
- https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/