PT-2019-5894 · Python+8 · Python+10
Publicado
2019-03-12
·
Atualizado
2024-07-12
·
CVE-2019-9740
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Python versions 2.x through 2.7.16
Python versions 3.x through 3.7.3
Description
The issue is related to the urllib2 module in Python, which does not properly neutralize CRLF sequences. This allows for CRLF injection if an attacker controls a URL parameter, such as the first argument to
urllib.request.urlopen with r in the query string after a ? character, followed by an HTTP header or a Redis command.Recommendations
For Python 2.x through 2.7.16, update to version 2.7.17 or later.
For Python 3.x through 3.7.3, update to version 3.7.4 or later.
As a temporary workaround, consider avoiding the use of the
urllib.request.urlopen function with untrusted URL parameters until a patch is applied.
Restrict access to the urllib module to minimize the risk of exploitation.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Linuxmint
Python
Red Hat
Rocky Linux
Suse
Ubuntu
Urllib
Urllib2