UnratedFix available

UBUNTU-CVE-2020-26137

Type: advisorySource: OSV1 source record

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

Announced 30 Sept 2020Source revision 1

Original source ↗

UBUNTU-CVE-2020-26137

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2020-26137

python-pip

Source reference: /affected/0/package/name

Affected versions: 1.4.1-2
Source reference: /affected/0/versions
1.5.4-1
Source reference: /affected/0/versions
1.5.4-1ubuntu1
Source reference: /affected/0/versions
1.5.4-1ubuntu3
Source reference: /affected/0/versions
1.5.4-1ubuntu4
Source reference: /affected/0/versions
1.5.4-1ubuntu4+esm1
Source reference: /affected/0/versions
1.5.4-1ubuntu4+esm2
Source reference: /affected/0/versions
1.5.4-1ubuntu4+esm3
Source reference: /affected/0/versions
1.5.4-1ubuntu4+esm4
Source reference: /affected/0/versions
1.5.4-1ubuntu4+esm5
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

python-pip

Source reference: /affected/1/package/name

Affected versions: 1.5.6-7ubuntu1
Source reference: /affected/1/versions
1.5.6-7ubuntu2
Source reference: /affected/1/versions
8.0.2-7
Source reference: /affected/1/versions
8.0.3-1
Source reference: /affected/1/versions
8.0.3-2
Source reference: /affected/1/versions
8.1.0-1
Source reference: /affected/1/versions
8.1.0-2
Source reference: /affected/1/versions
8.1.1-1
Source reference: /affected/1/versions
8.1.1-2
Source reference: /affected/1/versions
8.1.1-2ubuntu0.1
Source reference: /affected/1/versions
8.1.1-2ubuntu0.2
Source reference: /affected/1/versions
8.1.1-2ubuntu0.4
Source reference: /affected/1/versions
Fixed versions: 8.1.1-2ubuntu0.6
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

python-urllib3

Source reference: /affected/2/package/name

Affected versions: 1.11-1
Source reference: /affected/2/versions
1.12-1
Source reference: /affected/2/versions
1.13.1-1
Source reference: /affected/2/versions
1.13.1-2
Source reference: /affected/2/versions
1.13.1-2ubuntu0.16.04.1
Source reference: /affected/2/versions
1.13.1-2ubuntu0.16.04.2
Source reference: /affected/2/versions
1.13.1-2ubuntu0.16.04.3
Source reference: /affected/2/versions
Fixed versions: 1.13.1-2ubuntu0.16.04.4
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

python-pip

Source reference: /affected/3/package/name

Affected versions: 9.0.1-2
Source reference: /affected/3/versions
9.0.1-2.3~ubuntu1
Source reference: /affected/3/versions
9.0.1-2.3~ubuntu1.18.04.1
Source reference: /affected/3/versions
9.0.1-2.3~ubuntu1.18.04.2
Source reference: /affected/3/versions
Fixed versions: 9.0.1-2.3~ubuntu1.18.04.3
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

python-urllib3

Source reference: /affected/4/package/name

Affected versions: 1.21.1-1
Source reference: /affected/4/versions
1.22-1
Source reference: /affected/4/versions
1.22-1ubuntu0.18.04.1
Source reference: /affected/4/versions
Fixed versions: 1.22-1ubuntu0.18.04.2
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

python-pip

Source reference: /affected/5/package/name

Affected versions: 18.1-5
Source reference: /affected/5/versions
18.1-5build1
Source reference: /affected/5/versions
18.1-5ubuntu1
Source reference: /affected/5/versions
20.0.2-2
Source reference: /affected/5/versions
20.0.2-4
Source reference: /affected/5/versions
20.0.2-5
Source reference: /affected/5/versions
20.0.2-5ubuntu1
Source reference: /affected/5/versions
Fixed versions: 20.0.2-5ubuntu1.1
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

python-urllib3

Source reference: /affected/6/package/name

Affected versions: 1.24.1-1ubuntu1
Source reference: /affected/6/versions
1.24.1-1ubuntu2
Source reference: /affected/6/versions
1.25.8-1
Source reference: /affected/6/versions
1.25.8-2
Source reference: /affected/6/versions
Fixed versions: 1.25.8-2ubuntu0.1
Source reference: /affected/6/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "python-pip",
      "purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=esm-infra-legacy%2Ftrusty",
      "ecosystem": "Ubuntu:Pro:14.04:LTS"
    },
    "versions": [
      "1.4.1-2",
      "1.5.4-1",
      "1.5.4-1ubuntu1",
      "1.5.4-1ubuntu3",
      "1.5.4-1ubuntu4",
      "1.5.4-1ubuntu4+esm1",
      "1.5.4-1ubuntu4+esm2",
      "1.5.4-1ubuntu4+esm3",
      "1.5.4-1ubuntu4+esm4",
      "1.5.4-1ubuntu4+esm5"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-26137.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python-pip",
          "binary_version": "1.5.4-1ubuntu4+esm5"
        },
        {
          "binary_name": "python-pip-whl",
          "binary_version": "1.5.4-1ubuntu4+esm5"
        },
        {
          "binary_name": "python3-pip",
          "binary_version": "1.5.4-1ubuntu4+esm5"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "8.1.1-2ubuntu0.6"
          }
        ]
      }
    ],
    "package": {
      "name": "python-pip",
      "purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=xenial",
      "ecosystem": "Ubuntu:16.04:LTS"
    },
    "versions": [
      "1.5.6-7ubuntu1",
      "1.5.6-7ubuntu2",
      "8.0.2-7",
      "8.0.3-1",
      "8.0.3-2",
      "8.1.0-1",
      "8.1.0-2",
      "8.1.1-1",
      "8.1.1-2",
      "8.1.1-2ubuntu0.1",
      "8.1.1-2ubuntu0.2",
      "8.1.1-2ubuntu0.4"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-26137.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python-pip",
          "binary_version": "8.1.1-2ubuntu0.6"
        },
        {
          "binary_name": "python-pip-whl",
          "binary_version": "8.1.1-2ubuntu0.6"
        },
        {
          "binary_name": "python3-pip",
          "binary_version": "8.1.1-2ubuntu0.6"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.13.1-2ubuntu0.16.04.4"
          }
        ]
      }
    ],
    "package": {
      "name": "python-urllib3",
      "purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=xenial",
      "ecosystem": "Ubuntu:16.04:LTS"
    },
    "versions": [
      "1.11-1",
      "1.12-1",
      "1.13.1-1",
      "1.13.1-2",
      "1.13.1-2ubuntu0.16.04.1",
      "1.13.1-2ubuntu0.16.04.2",
      "1.13.1-2ubuntu0.16.04.3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-26137.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python-urllib3",
          "binary_version": "1.13.1-2ubuntu0.16.04.4"
        },
        {
          "binary_name": "python3-urllib3",
          "binary_version": "1.13.1-2ubuntu0.16.04.4"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.1-2.3~ubuntu1.18.04.3"
          }
        ]
      }
    ],
    "package": {
      "name": "python-pip",
      "purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=bionic",
      "ecosystem": "Ubuntu:18.04:LTS"
    },
    "versions": [
      "9.0.1-2",
      "9.0.1-2.3~ubuntu1",
      "9.0.1-2.3~ubuntu1.18.04.1",
      "9.0.1-2.3~ubuntu1.18.04.2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-26137.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python-pip",
          "binary_version": "9.0.1-2.3~ubuntu1.18.04.3"
        },
        {
          "binary_name": "python-pip-whl",
          "binary_version": "9.0.1-2.3~ubuntu1.18.04.3"
        },
        {
          "binary_name": "python3-pip",
          "binary_version": "9.0.1-2.3~ubuntu1.18.04.3"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.22-1ubuntu0.18.04.2"
          }
        ]
      }
    ],
    "package": {
      "name": "python-urllib3",
      "purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=bionic",
      "ecosystem": "Ubuntu:18.04:LTS"
    },
    "versions": [
      "1.21.1-1",
      "1.22-1",
      "1.22-1ubuntu0.18.04.1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-26137.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python-urllib3",
          "binary_version": "1.22-1ubuntu0.18.04.2"
        },
        {
          "binary_name": "python3-urllib3",
          "binary_version": "1.22-1ubuntu0.18.04.2"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "20.0.2-5ubuntu1.1"
          }
        ]
      }
    ],
    "package": {
      "name": "python-pip",
      "purl": "pkg:deb/ubuntu/python-pip?arch=source&distro=focal",
      "ecosystem": "Ubuntu:20.04:LTS"
    },
    "versions": [
      "18.1-5",
      "18.1-5build1",
      "18.1-5ubuntu1",
      "20.0.2-2",
      "20.0.2-4",
      "20.0.2-5",
      "20.0.2-5ubuntu1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-26137.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python-pip-whl",
          "binary_version": "20.0.2-5ubuntu1.1"
        },
        {
          "binary_name": "python3-pip",
          "binary_version": "20.0.2-5ubuntu1.1"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.25.8-2ubuntu0.1"
          }
        ]
      }
    ],
    "package": {
      "name": "python-urllib3",
      "purl": "pkg:deb/ubuntu/python-urllib3?arch=source&distro=focal",
      "ecosystem": "Ubuntu:20.04:LTS"
    },
    "versions": [
      "1.24.1-1ubuntu1",
      "1.24.1-1ubuntu2",
      "1.25.8-1",
      "1.25.8-2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-26137.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "python3-urllib3",
          "binary_version": "1.25.8-2ubuntu0.1"
        }
      ],
      "availability": "No subscription required"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #13772 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:29:58 GMT
Publisher date: Wed, 30 Sep 2020 00:00:00 GMT

Read the original announcement