Python CRLF注入漏洞

<a href="https://www.securityfocus.com/bid/91226" target="_blank">https://www.securityfocus.com/bid/91226</a><br/> <a href="http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201606-430" target="_blank">http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201606-430</a><br/>

Python是Python软件基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。Python 2.7.10之前的版本和3.4.4之前的3.x 版本中的urllib2和urllib中的‘HTTPConnection.putheader’函数存在CRLF注入漏洞。远程攻击者可借助URL中的CRLF序列利用该漏洞注入任意HTTP头。

来源:www.openwall.com
链接:http://www.openwall.com/lists/oss-security/2016/06/15/12
来源:blog.blindspotsecurity.com
链接:http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
来源:docs.python.org
链接:https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4
来源:hg.python.org
链接:https://hg.python.org/cpython/rev/1c45047c5102
来源:www.openwall.com
链接:http://www.openwall.com/lists/oss-security/2016/06/14/7
来源:hg.python.org
链接:https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS
来源:www.openwall.com
链接:http://www.openwall.com/lists/oss-security/2016/06/16/2
来源:hg.python.org
链接:https://hg.python.org/cpython/rev/bf3e1c9b80e9