Internet Bug Bounty · Report #590020
CRLF Injection in urllib
Validstatus
mediumseverity
$1,000bounty
341upvotes
6 May 2020disclosed
How it was found
Hi. I found CRLF Injection a few months ago. Please refer my bug issue. https://bugs.python.org/issue35906
Thank you
Impact
lead to SSRF. e.g. can exploit a internal redis server to send arbitrary packet data including ascii and non-ascii.