An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the fir…
Medium CVSS 6.1
Summary
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html Mailing List
- http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html Third Party Advisory
- http://www.openwall.com/lists/oss-security/2021/02/04/2 Mailing List
- http://www.securityfocus.com/bid/107466 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1260 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2030 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3335 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3520 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3725 Third Party Advisory
- https://bugs.python.org/issue36276 Exploit
- https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html Mailing List
- https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html Mailing List
- https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html Mailing List
- https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html Mailing List
- https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
- https://seclists.org/bugtraq/2019/Oct/29 Mailing List
- https://security.gentoo.org/glsa/202003-26 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190619-0005/ Third Party Advisory
- https://usn.ubuntu.com/4127-1/ Third Party Advisory
- https://usn.ubuntu.com/4127-2/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Timeline
- nvd_ingest NVD