CVE-2019-9740: CRLF Injection
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n followed by an HTTP header or a Redis command.
Reference: https://bugs.python.org/issue36276
Other sources
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-9740?
CVE-2019-9740 is a vulnerability discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
How severe is CVE-2019-9740?
CVE-2019-9740 has a severity level of 6.5 (medium).
How can an attacker exploit CVE-2019-9740?
An attacker can exploit CVE-2019-9740 by injecting CRLF sequences into a URL parameter that the attacker controls.
What is the affected software for CVE-2019-9740?
The affected software includes Python versions 2.x through 2.7.16 and Python 3.x through 3.7.3.
Are there any references for CVE-2019-9740?
Yes, you can find more information about CVE-2019-9740 in the following references: - [Bug Report on Python Bug Tracker](https://bugs.python.org/issue36276) - [Bug Report on Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1688170) - [Bug Report on Python Bug Tracker](https://bugs.python.org/issue30458)