Amazon Linux AMI update for python-pip

Published: 2020-02-07 | Updated: 2021-06-20

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2019-11236 CVE-2019-11324
CWE-ID	CWE-93 CWE-295
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) CRLF injection

EUVDB-ID: #VU26412

Risk: Medium

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-11236

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient filtration of user-supplied data passed via HTTP request parameters to urllib3 library. A remote attacker can pass specially crafted data that contains CRLF sequences and perform a spoofing attack.

Mitigation

Update the affected packages:

noarch:
    python27-pip-9.0.3-1.27.amzn1.noarch
    python35-pip-9.0.3-1.27.amzn1.noarch
    python26-pip-9.0.3-1.27.amzn1.noarch
    python36-pip-9.0.3-1.27.amzn1.noarch
    python34-pip-9.0.3-1.27.amzn1.noarch

src:
    python-pip-9.0.3-1.27.amzn1.src

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2020-1340.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Improper Certificate Validation

EUVDB-ID: #VU21780