Your submission was sent successfully! Close

CVE-2019-18348

Published: 23 October 2019

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

Notes

AuthorNote
leosilva
This issue can be reproducible only in systems with
the glibc issue mentioned in CVE-2016-10739 not fixed.
Priority

Medium

CVSS 3 base score: 6.1

Status

Package Release Status
python2.7
Launchpad, Ubuntu, Debian
bionic
Released (2.7.17-1~18.04ubuntu1)
disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Not vulnerable
(2.7.18~rc1-2)
groovy Not vulnerable
(2.7.18~rc1-2)
hirsute Not vulnerable
(2.7.18~rc1-2)
impish Not vulnerable
(2.7.18~rc1-2)
jammy Not vulnerable
(2.7.18~rc1-2)
kinetic Not vulnerable
(2.7.18~rc1-2)
precise
Released (2.7.3-0ubuntu3.17)
trusty
Released (2.7.6-8ubuntu0.6+esm5)
upstream Needs triage

xenial
Released (2.7.12-1ubuntu0~16.04.11)
Patches:
upstream: https://github.com/python/cpython/commit/e176e0c105786e9f476758eb5438c57223b65e7f



python3.4
Launchpad, Ubuntu, Debian
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Does not exist

trusty
Released (3.4.3-1ubuntu1~14.04.7+esm6)
upstream Needs triage

xenial Does not exist

python3.5
Launchpad, Ubuntu, Debian
bionic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Does not exist

trusty Needed

upstream Needs triage

xenial
Released (3.5.2-2ubuntu0~16.04.10)
python3.6
Launchpad, Ubuntu, Debian
bionic
Released (3.6.9-1~18.04ubuntu1)
disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

Patches:

upstream: https://github.com/python/cpython/commit/83fc70159b24f5b11a5ef87c9b05c2cf4c7faeba


python3.7
Launchpad, Ubuntu, Debian
bionic Needed

disco Ignored
(reached end-of-life)
eoan
Released (3.7.5-2~19.10ubuntu1)
focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

Patches:


upstream: https://github.com/python/cpython/commit/34f85af3229f86c004a954c3f261ceea1f5e9f95

python3.8
Launchpad, Ubuntu, Debian
bionic Needed

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal
Released (3.8.2-1ubuntu1.1)
groovy
Released (3.8.2-1ubuntu1.1)
hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

Patches:



upstream: https://github.com/python/cpython/commit/ff69c9d12c1b06af58e5eae5db4630cedd94740e