CVE-2019-9740: CRLF Injection
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
Other sources
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n followed by an HTTP header or a Redis command.
Reference: https://bugs.python.org/issue36276
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 0:2.7.5-86.el7 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 0:2.7.5-63.el7_4 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 0:2.7.5-74.el7_5 - Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 0:2.7.5-83.el7_6 - Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 0:3.6.8-15.1.el8 - Upgrade
Upgrade
redhat/python27-pythonto a version that resolves this vulnerability.Fixed in 0:2.7.16-4.el6 - Upgrade
Upgrade
redhat/python27-python-jinja2to a version that resolves this vulnerability.Fixed in 0:2.6-12.el6 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.9-2.el6 - Upgrade
Upgrade
redhat/python27-pythonto a version that resolves this vulnerability.Fixed in 0:2.7.16-4.el7 - Upgrade
Upgrade
redhat/python27-python-jinja2to a version that resolves this vulnerability.Fixed in 0:2.6-15.el7 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.9-2.el7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.1 - Upgrade
Upgrade
Python 2.xto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
Python 3.5to a version that resolves this vulnerability.Fixed in 3.5.8 - Upgrade
Upgrade
Python 3.6to a version that resolves this vulnerability.Fixed in 3.6.9 - Upgrade
Upgrade
Python 3.7to a version that resolves this vulnerability.Fixed in 3.7.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-9740?
CVE-2019-9740 is a vulnerability discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
How severe is CVE-2019-9740?
CVE-2019-9740 has a severity level of 6.5 (medium).
How can an attacker exploit CVE-2019-9740?
An attacker can exploit CVE-2019-9740 by injecting CRLF sequences into a URL parameter that the attacker controls.
What is the affected software for CVE-2019-9740?
The affected software includes Python versions 2.x through 2.7.16 and Python 3.x through 3.7.3.
Are there any references for CVE-2019-9740?
Yes, you can find more information about CVE-2019-9740 in the following references: - [Bug Report on Python Bug Tracker](https://bugs.python.org/issue36276) - [Bug Report on Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1688170) - [Bug Report on Python Bug Tracker](https://bugs.python.org/issue30458)