CVE-2019-18348 — Injection in Python
Severity
6.1MEDIUMNVD
OSV7.6OSV5.3
EPSS
2.7%
top 14.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 23
Latest updateJul 11
Description
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: …
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages5 packages
🔴Vulnerability Details
5OSV▶
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities↗2024-07-11
📋Vendor Advisories
6Microsoft▶
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter as demonstrated by the first↗2019-10-08
💬Community
10Bugzilla▶
CVE-2019-18348 python35: python: CRLF injection via the host part of the url passed to urlopen() [fedora-all]↗2019-10-24
Bugzilla▶
CVE-2019-18348 python34: python: CRLF injection via the host part of the url passed to urlopen() [fedora-all]↗2019-10-24
Bugzilla▶
CVE-2019-18348 python38: python: CRLF injection via the host part of the url passed to urlopen() [fedora-all]↗2019-10-24
Bugzilla▶
CVE-2019-18348 python36: python: CRLF injection via the host part of the url passed to urlopen() [epel-7]↗2019-10-24
Bugzilla▶
CVE-2019-18348 python36: python: CRLF injection via the host part of the url passed to urlopen() [fedora-all]↗2019-10-24