PT-2019-5894 · Python+8 · Python+10
Published
2019-03-12
·
Updated
2024-07-12
·
CVE-2019-9740
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Python versions 2.x through 2.7.16
Python versions 3.x through 3.7.3
Description
The issue is related to the urllib2 module in Python, which does not properly neutralize CRLF sequences. This allows for CRLF injection if an attacker controls a URL parameter, such as the first argument to
urllib.request.urlopen with r in the query string after a ? character, followed by an HTTP header or a Redis command.Recommendations
For Python 2.x through 2.7.16, update to version 2.7.17 or later.
For Python 3.x through 3.7.3, update to version 3.7.4 or later.
As a temporary workaround, consider avoiding the use of the
urllib.request.urlopen function with untrusted URL parameters until a patch is applied.
Restrict access to the urllib module to minimize the risk of exploitation.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Python
Red Hat
Rocky Linux
Suse
Ubuntu
Urllib
Urllib2