CVE-2022-0391: Input Validation
First published: Sun Apr 18 2021(Updated: )
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/python3 | <0:3.6.8-47.el8_6 | 0:3.6.8-47.el8_6 |
| redhat/rh-python38-babel | <0:2.7.0-12.el7 | 0:2.7.0-12.el7 |
| redhat/rh-python38-python | <0:3.8.11-2.el7 | 0:3.8.11-2.el7 |
| redhat/rh-python38-python-cryptography | <0:2.8-5.el7 | 0:2.8-5.el7 |
| redhat/rh-python38-python-jinja2 | <0:2.10.3-6.el7 | 0:2.10.3-6.el7 |
| redhat/rh-python38-python-lxml | <0:4.4.1-7.el7 | 0:4.4.1-7.el7 |
| redhat/rh-python38-python-pip | <0:19.3.1-2.el7 | 0:19.3.1-2.el7 |
| redhat/rh-python38-python-urllib3 | <0:1.25.7-7.el7 | 0:1.25.7-7.el7 |
| redhat/python27-python | <0:2.7.18-4.el7 | 0:2.7.18-4.el7 |
| Python Python | <3.6.14 | |
| Python Python | >=3.7.0<3.7.11 | |
| Python Python | >=3.8.0<3.8.11 | |
| Python Python | >=3.9.0<3.9.5 | |
| Python Python | =3.10.0-alpha1 | |
| Python Python | =3.10.0-alpha2 | |
| Python Python | =3.10.0-alpha3 | |
| Python Python | =3.10.0-alpha4 | |
| Python Python | =3.10.0-alpha5 | |
| Python Python | =3.10.0-alpha6 | |
| Netapp Active Iq Unified Manager Vsphere | ||
| Netapp Hci | ||
| Netapp Management Services For Element Software | ||
| NetApp ONTAP Select Deploy administration utility | ||
| Netapp Solidfire\, Enterprise Sds \& Hci Storage Node | ||
| Netapp Hci Compute Node | ||
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 | |
| Oracle HTTP Server | =12.2.1.3.0 | |
| Oracle HTTP Server | =12.2.1.4.0 | |
| Oracle ZFS Storage Appliance Kit | =8.8 | |
| redhat/python | <3.10.0 | 3.10.0 |
| redhat/python | <3.9.5 | 3.9.5 |
| redhat/python | <3.8.11 | 3.8.11 |
| redhat/python | <3.7.11 | 3.7.11 |
| redhat/python | <3.6.14 | 3.6.14 |
| IBM Cognos Analytics 11.2.x | <=IBM Cognos Analytics 11.2.x | |
| IBM Cognos Analytics 11.1.x | <=IBM Cognos Analytics 11.1.x | |
| debian/pypy3 | <=7.3.5+dfsg-2+deb11u2 | 7.3.11+dfsg-2+deb12u2 7.3.17+dfsg-2 |
| debian/python2.7 | 2.7.18-8+deb11u1 | |
| debian/python3.9 | <=3.9.2-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-0391 https://nvd.nist.gov/vuln/detail/CVE-2022-0391
- https://bugzilla.redhat.com/show_bug.cgi?id=2047376
- https://access.redhat.com/errata/RHSA-2022:1764
- https://access.redhat.com/errata/RHSA-2022:1821
- https://access.redhat.com/errata/RHSA-2022:6457
- https://access.redhat.com/errata/RHSA-2021:3254
- https://access.redhat.com/errata/RHSA-2022:1663
- https://access.redhat.com/security/cve/cve-2022-0391
- https://bugs.python.org/issue43882
- https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20220225-0009/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047377
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047578
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047579
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047585
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047587
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047580
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047581
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047582
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047583
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047584
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047577
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2292369
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047376#c3
- https://access.redhat.com/security/cve/CVE-2022-0391
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2047376#c35
- https://errata.devel.redhat.com/advisory/81331/builds
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/
- https://launchpad.net/bugs/cve/CVE-2022-0391
- https://exchange.xforce.ibmcloud.com/vulnerabilities/219613
- https://www.ibm.com/support/pages/node/6828527 (Advisory)
- https://github.com/python/cpython/commit/76cd81d60310d65d01f9d7b48a8985d8ab89c8b4
- https://github.com/python/cpython/commit/24f1d1a8a2c4aa58a606b4b6d5fa4305a3b91705
- https://github.com/python/cpython/commit/491fde0161d5e527eeff8586dd3972d7d3a631a7
- https://github.com/python/cpython/commit/8a595744e696a0fb92dccc5d4e45da41571270a1
- https://github.com/python/cpython/commit/515a7bc4e13645d0945b46a8e1d9102b918cd407
- https://github.com/python/cpython/commit/f4dac7ec55477a6c5d965e594e74bd6bda786903
- https://github.com/python/cpython/commit/6c472d3a1d334d4eeb4a25eba7bf3b01611bf667
- https://security-tracker.debian.org/tracker/CVE-2022-0391
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0391
- https://nvd.nist.gov/vuln/detail/CVE-2022-0391
- https://ubuntu.com/security/CVE-2022-0391
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-0391?
CVE-2022-0391 is a vulnerability in Python that allows characters like '\r' and '\n' in the URL path, resulting in weaker than expected security.
What is the severity of CVE-2022-0391?
CVE-2022-0391 has a severity score of 7.5 (High).
How does CVE-2022-0391 affect Python?
CVE-2022-0391 affects Python versions up to 3.10.0 and allows improper input validation in the urllib.parse module.
How can I fix CVE-2022-0391?
To fix CVE-2022-0391, upgrade to Python version 3.10.0 or apply the appropriate remedy provided by Red Hat.
Where can I find more information about CVE-2022-0391?
You can find more information about CVE-2022-0391 in the references provided: [link1], [link2].
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/severity
- agent/weakness
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-0391
- agent/software-canonical-lookup
- agent/remedy
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- collector/launchpad-cve
- source/Launchpad
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- collector/ibm-support
- source/IBM
- agent/references
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- package-manager/redhat
- vendor/python
- canonical/python python
- version/python python/3.7.0
- version/python python/3.8.0
- version/python python/3.9.0
- version/python python/3.10.0-alpha1
- version/python python/3.10.0-alpha2
- version/python python/3.10.0-alpha3
- version/python python/3.10.0-alpha4
- version/python python/3.10.0-alpha5
- version/python python/3.10.0-alpha6
- vendor/netapp
- canonical/netapp active iq unified manager vsphere
- canonical/netapp hci
- canonical/netapp management services for element software
- canonical/netapp ontap select deploy administration utility
- canonical/netapp solidfire\, enterprise sds \& hci storage node
- canonical/netapp hci compute node
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35
- vendor/oracle
- canonical/oracle http server
- version/oracle http server/12.2.1.3.0
- version/oracle http server/12.2.1.4.0
- canonical/oracle zfs storage appliance kit
- version/oracle zfs storage appliance kit/8.8
- vendor/ibm
- canonical/ibm cognos analytics 11.2.x
- version/ibm cognos analytics 11.2.x/ibm cognos analytics 11.2.x
- canonical/ibm cognos analytics 11.1.x
- version/ibm cognos analytics 11.1.x/ibm cognos analytics 11.1.x
- package-manager/debian