CVE-2019-18348Injection in Python

Severity
6.1MEDIUMNVD
OSV7.6OSV5.3
EPSS
2.7%
top 14.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 23
Latest updateJul 11

Description

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in:

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

NVDpython/python3.03.5.10+4
debiandebian/python2.7< python2.7 2.7.18~rc1-1 (bullseye)

🔴Vulnerability Details

5
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities2024-07-11
GHSA
GHSA-v3f8-6665-x7rx: An issue was discovered in urllib2 in Python 22022-05-24
OSV
python3.8 vulnerabilities2020-04-30
OSV
python2.7, python3.4, python3.5, python3.6, python3.7 vulnerabilities2020-04-21
OSV
CVE-2019-18348: An issue was discovered in urllib2 in Python 22019-10-23

📋Vendor Advisories

6
Ubuntu
Python vulnerabilities2024-07-11
Ubuntu
Python vulnerabilities2020-04-30
Ubuntu
Python vulnerabilities2020-04-21
Microsoft
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter as demonstrated by the first2019-10-08
Red Hat
python: CRLF injection via the host part of the url passed to urlopen()2019-07-04

💬Community

10
Bugzilla
CVE-2019-18348 python35: python: CRLF injection via the host part of the url passed to urlopen() [fedora-all]2019-10-24
Bugzilla
CVE-2019-18348 python34: python: CRLF injection via the host part of the url passed to urlopen() [fedora-all]2019-10-24
Bugzilla
CVE-2019-18348 python38: python: CRLF injection via the host part of the url passed to urlopen() [fedora-all]2019-10-24
Bugzilla
CVE-2019-18348 python36: python: CRLF injection via the host part of the url passed to urlopen() [epel-7]2019-10-24
Bugzilla
CVE-2019-18348 python36: python: CRLF injection via the host part of the url passed to urlopen() [fedora-all]2019-10-24