PT-2019-20149 · Python · Urllib3

Published 2019-04-15 · Updated 2019-04-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.24.2

Description The issue allows for CRLF injection if the attacker controls the request parameter.

Recommendations For versions prior to 1.24.2, update to version 1.24.2 or later to resolve the issue.

Related Identifiers

PYSEC-2019-62

Affected Products

Urllib3

References · 14

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-62 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2 · Vendor Advisory
• https://github.com/urllib3/urllib3/issues/1553 · Note
• https://usn.ubuntu.com/3990-2 · Note
• https://access.redhat.com/errata/RHSA-2019:3335 · Note
• https://usn.ubuntu.com/3990-1 · Note
• https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html · Note
• https://access.redhat.com/errata/RHSA-2019:2272 · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html · Note
• https://access.redhat.com/errata/RHSA-2019:3590 · Note