CVE-2019-18348: CRLF Injection
A CRLF injection flaw was discovered in python in the way URLs are handled when doing an HTTP/HTTPS connection (e.g. through urlopen() or HTTPConnection). An attacker who can control the url parameter passed to urlopen method in the urllib/urllib2 modules can inject CRLF sequences and HTTP headers by abusing the "host" part of the URL.
Other sources
An issue was discovered in urllib/urllib2 in Python. CRLF injection is possible if the attacker controls the host part of the url parameter passed to urlopen().
The fix for CVE-2019-9947 is ineffective if the glibc version used by python is still affected by CVE-2016-10739. The original fix for CVE-2019-9947 only checked the part of the URL after the port (e.g. in "http://server:7777/my/path?query" only "/my/path?query" was checked for invalid characters) so if an attacker can control the hostname part he is still able to inject HTTP headers. Due to CVE-2016-10739, getaddrinfo() resolves an invalid hostname as a valid one, so the URL can contain CLRF sequences and, at the same time, it can be resolved to a valid host.
Reference: https://bugs.python.org/issue30458#msg347282
— Red Hat
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.12-1.el6 - Upgrade
Upgrade
redhat/rh-python36-python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.1-5.el6 - Upgrade
Upgrade
redhat/rh-python36-python-virtualenvto a version that resolves this vulnerability.Fixed in 0:15.1.0-3.el6 - Upgrade
Upgrade
redhat/python27-pythonto a version that resolves this vulnerability.Fixed in 0:2.7.18-2.el7 - Upgrade
Upgrade
redhat/python27-python-pipto a version that resolves this vulnerability.Fixed in 0:8.1.2-6.el7 - Upgrade
Upgrade
redhat/python27-python-virtualenvto a version that resolves this vulnerability.Fixed in 0:13.1.0-4.el7 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.12-1.el7 - Upgrade
Upgrade
redhat/rh-python36-python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.1-5.el7 - Upgrade
Upgrade
redhat/rh-python36-python-virtualenvto a version that resolves this vulnerability.Fixed in 0:15.1.0-3.el7 - Upgrade
Upgrade
debian/python2.7to a version that resolves this vulnerability.Fixed in 2.7.18-8+deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.18rc1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.10rc1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.11rc1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.8rc1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.3rc1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.4rc1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.6rc1 - Compensating control
Ensure the glibc version used by Python is not affected by CVE-2016-10739; otherwise, the fix for CVE-2019-9947 is ineffective (CRLF injection can still be possible because getaddrinfo() resolves an invalid hostname as a valid one).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-18348?
CVE-2019-18348 is a CRLF injection vulnerability in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
What is the severity of CVE-2019-18348?
The severity of CVE-2019-18348 is medium with a CVSS score of 6.5.
How can an attacker exploit CVE-2019-18348?
An attacker can exploit CVE-2019-18348 by controlling a URL parameter to perform CRLF injection.
Which versions of Python are affected by CVE-2019-18348?
Python 2.x through 2.7.17 and Python 3.x through 3.8.0 are affected by CVE-2019-18348.
Is there a fix for CVE-2019-18348?
Yes, the fix for CVE-2019-18348 is available in the respective Python versions: 2.7.18 and 3.8.1.