CVE:CVE-2020-26116
CNNVD:CNNVD-202009-1621
Python是Python基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。
Python http.client存在注入漏洞。该漏洞源于用户输入构造命令、数据结构或记录的操作过程中，网络系统或产品缺乏对用户输入数据的正确验证，未过滤或未正确过滤掉其中的特殊元素，导致系统或产品产生解析或解释方式错误。以下产品及版本受到影响：Python 3.x系列3.5.10之前版本, 3.6.x系列3.6.12之前版本, 3.7.x系列3.7.9之前版本, 3.8.x系列3.8.5之前版本。
solution:Upgrade python python to a higher version than 3.5.10,3.6.12,3.7.9,3.8.5,and avoid the version [3.0.0,3.5.10),[3.6.0,3.6.12),[3.7.0,3.7.9),[3.8.0,3.8.5); Upgrade fedoraproject fedora to a higher version than 31,32,33,and avoid the version 31,32,33; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,16.04,18.04,and avoid the version 12.04,14.04,16.04,18.04; Upgrade netapp solidfire to a higher version than -; Upgrade netapp hci_storage_node to a higher version than -; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade oracle zfs_storage_appliance_kit to a higher version than 8.8,and avoid the version 8.8; Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1