CRLF injection in Python - CVE-2019-9740

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18829

CRLF injection in Python - CVE-2019-9740

Published: June 19, 2019 / Updated: July 20, 2020


Vulnerability identifier: #VU18829
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2019-9740
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Python.org
Affected software:
Python

Detailed vulnerability description

The vulnerability allows a remote attacker to perform CRLF injection attacks.

The vulnerability exists within urllib2 implementation for Python 2.x and urllib3 implementation for Python 3.x when processing the path component of a URL after the "?" character within the urllib.request.urlopen() call. A remote attacker with ability to control URL, passed to the application, can use CRLF sequences to split the HTTP request and inject arbitrary HTTP headers into request, made by the application.


How to mitigate CVE-2019-9740

Install update from vendor's website.

Sources