CRLF injection in Python - CVE-2019-18348

Vulnerability identifier: #VU31958

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-18348

CWE-ID: CWE-74

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.)

Python
Amazon Linux AMI
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE OpenStack Cloud
SUSE Enterprise Storage
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Workstation Extension
Ubuntu
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise High Performance Computing
Opensuse
openSUSE Leap
Fedora
python2-tkinter (Alpine package)
python3.11 (Ubuntu package)
python3.5-minimal (Ubuntu package)
python3.5 (Ubuntu package)
python3.7-minimal (Ubuntu package)
python3.7 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python3.6 (Ubuntu package)
python3.9-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.8 (Ubuntu package)
python3.11-minimal (Ubuntu package)
python-curses-debuginfo
python-base-debuginfo
python-base-debuginfo-32bit
python-base-debugsource
python-curses
python-base-32bit
python-debuginfo
python-debuginfo-32bit
python-debugsource
python-demo
python-devel
python-gdbm
python-gdbm-debuginfo
python-idle
python-tk
python-tk-debuginfo
python-xml
python-xml-debuginfo
python-doc
python-doc-pdf
python-32bit
python
libpython2_7-1_0-debuginfo-32bit
libpython2_7-1_0-debuginfo
libpython2_7-1_0-32bit
libpython2_7-1_0
python-base
python35
python36
python3-doc-devhelp
python3-doc
python3-dbm
python3-base-debuginfo
python3-core-debugsource
python3-debuginfo
python3-debugsource
python3-curses
python3-base
python3-curses-debuginfo
python3-tk
python3
libpython3_6m1_0-debuginfo
libpython3_6m1_0
python3-tk-debuginfo
python3-tools
python3-dbm-debuginfo
libpython3_6m1_0-32bit
libpython3_6m1_0-32bit-debuginfo
python3-devel
python3-devel-debuginfo
python3-idle
python3-testsuite
python3-testsuite-debuginfo
python3.10-minimal (Ubuntu package)
python3.10 (Ubuntu package)
python3.12-minimal (Ubuntu package)
python3.12 (Ubuntu package)
BIG-IP
IBM Qradar SIEM
IBM Robotic Process Automation

Install update from vendor's website.

Python - addressed in versions 2.7.18, 3.8.1
python2-tkinter (Alpine package) - update to 2.7.18-r0
python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.5-minimal (Ubuntu package) - update to Ubuntu Pro
python3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.7-minimal (Ubuntu package) - update to Ubuntu Pro
python3.7 (Ubuntu package) - update to Ubuntu Pro
python3.6-minimal (Ubuntu package) - update to Ubuntu Pro
python3.6 (Ubuntu package) - update to Ubuntu Pro
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python-curses-debuginfo - update to 2.7.18-28.67.1
python-base-debuginfo - update to 2.7.18-28.67.1
python-base-debuginfo-32bit - update to 2.7.18-28.67.1
python-base-debugsource - update to 2.7.18-28.67.1
python-curses - update to 2.7.18-28.67.1
python-base-32bit - update to 2.7.18-28.67.1
python-debuginfo - update to 2.7.18-28.67.1
python-debuginfo-32bit - update to 2.7.18-28.67.1
python-debugsource - update to 2.7.18-28.67.1
python-demo - update to 2.7.18-28.67.1
python-devel - update to 2.7.18-28.67.1
python-gdbm - update to 2.7.18-28.67.1
python-gdbm-debuginfo - update to 2.7.18-28.67.1
python-idle - update to 2.7.18-28.67.1
python-tk - update to 2.7.18-28.67.1
python-tk-debuginfo - update to 2.7.18-28.67.1
python-xml - update to 2.7.18-28.67.1
python-xml-debuginfo - update to 2.7.18-28.67.1
python-doc - update to 2.7.18-28.67.1
python-doc-pdf - update to 2.7.18-28.67.1
python-32bit - update to 2.7.18-28.67.1
python - update to 2.7.18-28.67.1
libpython2_7-1_0-debuginfo-32bit - update to 2.7.18-28.67.1
libpython2_7-1_0-debuginfo - update to 2.7.18-28.67.1
libpython2_7-1_0-32bit - update to 2.7.18-28.67.1
libpython2_7-1_0 - update to 2.7.18-28.67.1
python-base - update to 2.7.18-28.67.1
python35 - addressed in versions 3.5.8-2.fc29, 3.5.8-2.fc30, 3.5.8-2.fc31
python36 - addressed in versions 3.6.11-1.fc31, 3.6.11-1.fc32
python3-doc-devhelp - update to 3.6.15-150300.10.37.1
python3-doc - update to 3.6.15-150300.10.37.1
python3-dbm - update to 3.6.15-150300.10.37.2
python3-base-debuginfo - update to 3.6.15-150300.10.37.2
python3-core-debugsource - update to 3.6.15-150300.10.37.2
python3-debuginfo - update to 3.6.15-150300.10.37.2
python3-debugsource - update to 3.6.15-150300.10.37.2
python3-curses - update to 3.6.15-150300.10.37.2
python3-base - update to 3.6.15-150300.10.37.2
python3-curses-debuginfo - update to 3.6.15-150300.10.37.2
python3-tk - update to 3.6.15-150300.10.37.2
python3 - update to 3.6.15-150300.10.37.2
libpython3_6m1_0-debuginfo - update to 3.6.15-150300.10.37.2
libpython3_6m1_0 - update to 3.6.15-150300.10.37.2
python3-tk-debuginfo - update to 3.6.15-150300.10.37.2
python3-tools - update to 3.6.15-150300.10.37.2
python3-dbm-debuginfo - update to 3.6.15-150300.10.37.2
libpython3_6m1_0-32bit - update to 3.6.15-150300.10.37.2
libpython3_6m1_0-32bit-debuginfo - update to 3.6.15-150300.10.37.2
python3-devel - update to 3.6.15-150300.10.37.2
python3-devel-debuginfo - update to 3.6.15-150300.10.37.2
python3-idle - update to 3.6.15-150300.10.37.2
python3-testsuite - update to 3.6.15-150300.10.37.2
python3-testsuite-debuginfo - update to 3.6.15-150300.10.37.2
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM Robotic Process Automation - update to 21.0.5

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html
• https://bugs.python.org/issue30458#msg347282
• https://bugzilla.redhat.com/show_bug.cgi?id=1727276
• https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/
• https://security.netapp.com/advisory/ntap-20191107-0004/
• https://usn.ubuntu.com/4333-1/
• https://usn.ubuntu.com/4333-2/

• CRLF injection in Python
• OpenSUSE Linux update for python
• CRLF injection in python2-tkinter (Alpine package)
• Amazon Linux AMI update for python34, python35
• Amazon Linux AMI update for python36
• SUSE update for python3
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• SUSE update for python
• Multiple vulnerabilities in IBM QRadar SIEM
• Ubuntu update for python3.10
• Fedora 30 update for python35
• Fedora 29 update for python35
• Fedora 31 update for python35
• Fedora 31 update for python36
• Fedora 32 update for python36
• Multiple vulnerabilities in F5 BIG-IP Python component