CRLF injection in urllib3 - CVE-2019-11236

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU26412

CRLF injection in urllib3 - CVE-2019-11236

Published: March 26, 2020 / Updated: June 20, 2021


Vulnerability identifier: #VU26412
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-11236
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient filtration of user-supplied data passed via HTTP request parameters to urllib3 library. A remote attacker can pass specially crafted data that contains CRLF sequences and perform a spoofing attack.


Affected software

urllib3
Amazon Linux AMI
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
CentOS
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Fedora
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Opensuse
Dell EMC PowerProtect Data Protection
SmartFabric OS10
QRadar Deployment Intelligence App
DataStage on Cloud Pak for Data
SOAR QRadar Plugin App
Maximo Application Suite - IoT Component
Robotic Process Automation for Cloud Pak
Splunk User Behavior Analytics (UBA)
IBM Cloud Pak for Business Automation
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Pak for Data Scheduling
Data Replication on Cloud Pak for Data
IBM Spectrum Symphony
IBM Robotic Process Automation
RecoverPoint for Virtual Machines
python-pip (Red Hat package)
python-virtualenv (Red Hat package)
skopeo (Red Hat package)
runc (Red Hat package)
python-urllib3 (Red Hat package)
python-urllib3
openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
machine-config-daemon (Red Hat package)
openshift-clients (Red Hat package)
jenkins-2-plugins (Red Hat package)
python-pip-epel
python3-virtualenv
python-pip
Red Hat OpenShift Container Platform

How to mitigate CVE-2019-11236

Install updates from vendor's website.

urllib3 - update to 1.24.3
Dell EMC PowerProtect Data Protection - update to 2.7.8
Splunk User Behavior Analytics (UBA) - update to 5.4.2
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
python-pip (Red Hat package) - addressed in versions 9.0.3-7.el7_7, 9.0.3-7.el7_8, 9.0.3-16.el8
SmartFabric OS10 - addressed in versions 10.5.4.11, 10.5.6.1
python-virtualenv (Red Hat package) - addressed in versions 15.1.0-4.el7_7, 15.1.0-4.el7_8
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
skopeo (Red Hat package) - update to 0.1.40-5.rhaos.el8
runc (Red Hat package) - addressed in versions 1.0.0-69.rhaos4.4.git81f3917.el7, 1.0.0-69.rhaos4.4.git81f3917.el8
python-urllib3 (Red Hat package) - addressed in versions 1.10.2-7.el7, 1.24.2-2.el8, 1.24.3-1.el7
python-urllib3 - addressed in versions 1.24.3-1.fc29, 1.24.3-1.fc30
QRadar Deployment Intelligence App - update to 3.0.16
Red Hat OpenShift Container Platform - addressed in versions 4.3.28, 4.4.11
openshift (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.0.3d5309c.el7, 4.3.28-202006270952.p0.git.0.3d5309c.el8, 4.4.0-202006271254.p0.git.0.00954ea.el7, 4.4.0-202006271254.p0.git.0.00954ea.el8
openshift-ansible (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.0.c07ec65.el7, 4.4.0-202006271254.p0.git.0.d256229.el7
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.13.4a5b28a.el7, 4.4.0-202006271254.p0.git.13.6b09c66.el7
openshift-kuryr (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.1632.9e3ea83.el8, 4.4.0-202006271254.p0.git.1811.c15bfa2.el8
atomic-enterprise-service-catalog (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.1806.b12beb7.el7, 4.4.0-202006271254.p0.git.1806.44e1f58.el7
machine-config-daemon (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.2178.08d8005.el8, 4.4.0-202006271254.p0.git.2337.29601a9.el8
openshift-clients (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.3325.7c2f859.el7, 4.3.28-202006270952.p0.git.3325.7c2f859.el8, 4.4.0-202006271254.p0.git.3436.9f4fcab.el7, 4.4.0-202006271254.p0.git.3436.9f4fcab.el8
jenkins-2-plugins (Red Hat package) - update to 4.3.1593080425-1.el7
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1
IBM Cloud Pak for Data Scheduling - update to 4.8.0
Data Replication on Cloud Pak for Data - update to 4.8.0
DataStage on Cloud Pak for Data - update to 4.8.4
SOAR QRadar Plugin App - update to 5.4.0
IBM Spectrum Symphony - update to 7.3.2 Fix 601860
python-pip-epel - addressed in versions 8.1.2-11.el7, 8.1.2-12.el7
Maximo Application Suite - IoT Component - addressed in versions 8.7.21, 8.8.17, 9.0.7
python3-virtualenv - update to 15.1.0-5.el7
python-pip - addressed in versions 19.0.3-6.fc30, 19.1.1-7.fc31
Robotic Process Automation for Cloud Pak - update to 21.0.7.19
IBM Robotic Process Automation - update to 21.0.7.19

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins