CVE-2019-11236

CWE-93CWE-11321 documents9 sources
Severity
6.1MEDIUM
EPSS
0.6%
top 29.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Python Urllib3
Timeline
PublishedApr 15
Latest updateMay 13

Description

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶Debianpython-urllib3< 1.25.6-4+3
▶Ubuntupython-urllib3< 1.13.1-2ubuntu0.16.04.3+2
▶NVDpython/urllib31.24.2
▶PyPIurllib3< 1.24.3

🔴Vulnerability Details

6
GHSA
Improper Neutralization of CRLF Sequences in urllib3 library for Python↗2022-05-13
▶
OSV
Improper Neutralization of CRLF Sequences in urllib3 library for Python↗2022-05-13
▶
OSV
python-urllib3 vulnerability↗2019-07-29
▶
OSV
python-urllib3 vulnerabilities↗2019-05-21
▶
OSV
CVE-2019-11236: In the urllib3 library through 1↗2019-04-15
▶

📋Vendor Advisories

5
Ubuntu
urllib3 vulnerability↗2019-07-29
▶
Ubuntu
urllib3 vulnerabilities↗2019-05-21
▶
Microsoft
In the urllib3 library through 1.24.1 for Python CRLF injection is possible if the attacker controls the request parameter.↗2019-04-09
▶
Red Hat
python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service↗2019-03-13
▶
Debian
CVE-2019-11236: python-urllib3 - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if ...↗2019
▶

💬Community

9
Bugzilla
CVE-2019-11236 python3-virtualenv: python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service [epel-7]↗2019-11-29
▶
Bugzilla
CVE-2019-11236 python-virtualenv: python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service [epel-6]↗2019-11-29
▶
Bugzilla
CVE-2019-11236 python-virtualenv: python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service [fedora-30]↗2019-11-29
▶
Bugzilla
CVE-2019-11236 python-pip: python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service [epel-6]↗2019-11-21
▶
Bugzilla
CVE-2019-11236 python-pip-epel: python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service [epel-7]↗2019-11-21
▶