#VU18829 CRLF injection in Python - CVE-2019-9740

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18829

#VU18829 CRLF injection in Python - CVE-2019-9740

Published: June 19, 2019 / Updated: July 20, 2020


Vulnerability identifier: #VU18829
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2019-9740
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Python
Software vendor:
Python.org

Description

The vulnerability allows a remote attacker to perform CRLF injection attacks.

The vulnerability exists within urllib2 implementation for Python 2.x and urllib3 implementation for Python 3.x when processing the path component of a URL after the "?" character within the urllib.request.urlopen() call. A remote attacker with ability to control URL, passed to the application, can use CRLF sequences to split the HTTP request and inject arbitrary HTTP headers into request, made by the application.


Remediation

Install update from vendor's website.

External links