CVE-2022-0391
published 2022-02-09CVE-2022-0391: A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The…
PriorityP350high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
8.33%
94.3th percentile
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypy3 | < pypy3 7.3.6+dfsg-1 (bookworm) | pypy3 7.3.6+dfsg-1 (bookworm) |
| debian | python2.7 | < pypy3 7.3.6+dfsg-1 (bookworm) | pypy3 7.3.6+dfsg-1 (bookworm) |
| debian | python3.9 | < pypy3 7.3.6+dfsg-1 (bookworm) | pypy3 7.3.6+dfsg-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cm1_python2_2.7.18-9_on_cbl_mariner_1.0 | — | — |
| msrc | cm1_python3_3.7.10-6_on_cbl_mariner_1.0 | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | zfs_storage_appliance_kit | — | — |
| python | python | < 3.6.14 | 3.6.14 |
| python | python | — | — |
| python | python | — | — |
| python | python | >= 3.7.0 < 3.7.11 | 3.7.11 |
| python | python | >= 3.8.0 < 3.8.11 | 3.8.11 |
| python | python | >= 3.9.0 < 3.9.5 | 3.9.5 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.6HIGH
cisa9.8CRITICAL
vendor_ubuntu7.6HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
osv·2024-07-11·CVSS 7.6
CVE-2015-20107 [HIGH] python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 L
OSV
python2.7 vulnerabilities
osv·2022-08-24·CVSS 5.3
CVE-2021-4189 [MEDIUM] python2.7 vulnerabilities
python2.7 vulnerabilities
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for Ubuntu 14.04 ESM, Ubuntu 20.04 ESM and
Ubuntu 22.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
OSV
python3.7 vulnerability
osv·2022-05-23·CVSS 5.7
CVE-2021-3426 [MEDIUM] python3.7 vulnerability
python3.7 vulnerability
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding fix for CVE-2021-3426 for Ubuntu 18.04 ESM.
Original advisory details:
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
OSV
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
osv·2022-03-28·CVSS 5.7
CVE-2021-3426 [MEDIUM] python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
GHSA
GHSA-75jm-2xrg-5wpf: A flaw was found in Python, specifically within the urllib
ghsa_unreviewed·2022-02-11
CVE-2022-0391 [HIGH] CWE-74 GHSA-75jm-2xrg-5wpf: A flaw was found in Python, specifically within the urllib
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
OSV
CVE-2022-0391: A flaw was found in Python, specifically within the urllib
osv·2022-02-09·CVSS 7.5
CVE-2022-0391 [HIGH] CVE-2022-0391: A flaw was found in Python, specifically within the urllib
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-07-11·CVSS 7.6
CVE-2021-29921 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-14647)
Ubuntu
Python vulnerabilities
vendor_ubuntu·2022-08-24·CVSS 5.3
CVE-2022-0391 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for Ubuntu 14.04 ESM, Ubuntu 20.04 ESM and
Ubuntu 22.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Python vulnerability
vendor_ubuntu·2022-05-23·CVSS 5.7
CVE-2021-3426 [MEDIUM] Python vulnerability
Title: Python vulnerability
Summary: Python could be made to expose sensitive information.
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding fix for CVE-2021-3426 for Ubuntu 18.04 ESM.
Original advisory details:
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could pos
Ubuntu
Python vulnerabilities
vendor_ubuntu·2022-03-28·CVSS 5.7
CVE-2022-0391 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
A flaw was found in Python specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does
vendor_msrc·2022-02-08·CVSS 7.5
CVE-2022-0391 [HIGH] CWE-74 A flaw was found in Python specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does
A flaw was found in Python specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1 3.9.5 3.8.11 3.7.11 and 3.6.14.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which
CISA
Apache Struts 2 Improper Input Validation Vulnerability
cisa·2022-01-21·CVSS 9.8
CVE-2012-0391 [CRITICAL] CWE-20 Apache Struts 2 Improper Input Validation Vulnerability
Vulnerability: Apache Struts 2 Improper Input Validation Vulnerability
Affected: Apache Struts 2
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2012-0391
Remediation Due Date: 2022-07-21
Debian
CVE-2022-0391: pypy3 - A flaw was found in Python, specifically within the urllib.parse module. This mo...
vendor_debian·2022·CVSS 7.5
CVE-2022-0391 [HIGH] CVE-2022-0391: pypy3 - A flaw was found in Python, specifically within the urllib.parse module. This mo...
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
Scope: local
bookworm: resolved (fixed in 7.3.6+dfsg-1)
bullseye: resolved (fixed in 7.3.5+dfsg-2+deb11u4)
forky: resolved (fixed in 7.3.6+dfsg-1)
sid: resolved (fixed in 7.3.6+dfsg-1)
trixie: resolved (fixed in 7.3.6+dfsg-1)
Red Hat
python: urllib.parse does not sanitize URLs containing ASCII newline and tabs
vendor_redhat·2021-04-18·CVSS 7.5
CVE-2022-0391 [HIGH] CWE-74 python: urllib.parse does not sanitize URLs containing ASCII newline and tabs
python: urllib.parse does not sanitize URLs containing ASCII newline and tabs
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugs.python.org/issue43882https://lists.debian.org/debian-lts-announce/2023/09/msg00022.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/https://security.gentoo.org/glsa/202305-02https://security.netapp.com/advisory/ntap-20220225-0009/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://bugs.python.org/issue43882https://lists.debian.org/debian-lts-announce/2023/09/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2024/11/msg00024.htmlhttps://lists.debian.org/debian-lts-announce/2025/03/msg00013.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/https://security.gentoo.org/glsa/202305-02https://security.netapp.com/advisory/ntap-20220225-0009/https://www.oracle.com/security-alerts/cpuapr2022.html
2022-02-09
Published