CVE-2019-18348

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-18348
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-18348.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-18348
Aliases
Related
Published
2019-10-23T17:15:12Z
Modified
2024-07-30T06:11:22.308793Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

References

Affected packages

Alpine:v3.10 / python2

Package

Name
python2
Purl
pkg:apk/alpine/python2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.18-r0

Affected versions

2.*

2.6.1-r0
2.6.1-r1
2.6.1-r2
2.6.2-r0
2.6.2-r1
2.6.3-r0
2.6.4-r0
2.6.5-r0
2.6.5-r1
2.6.5-r2
2.6.5-r3
2.6.5-r4
2.6.5-r5
2.6.5-r6
2.6.5-r7
2.6.5-r8
2.7.2-r0
2.7.2-r2
2.7.2-r3
2.7.3-r3
2.7.3-r4
2.7.3-r5
2.7.5-r0
2.7.5-r1
2.7.5-r2
2.7.5-r3
2.7.6-r0
2.7.6-r1
2.7.6-r2
2.7.6-r3
2.7.6-r4
2.7.7-r0
2.7.8-r0
2.7.9-r0
2.7.9-r1
2.7.9-r2
2.7.9-r3
2.7.9-r4
2.7.10-r0
2.7.10-r1
2.7.10-r2
2.7.10-r3
2.7.11-r0
2.7.11-r1
2.7.11-r2
2.7.11-r3
2.7.11-r4
2.7.11-r5
2.7.12-r0
2.7.12-r1
2.7.12-r2
2.7.12-r3
2.7.12-r4
2.7.12-r5
2.7.12-r6
2.7.12-r7
2.7.13-r0
2.7.13-r1
2.7.13-r2
2.7.14-r0
2.7.14-r1
2.7.14-r2
2.7.14-r3
2.7.14-r4
2.7.15-r0
2.7.15-r1
2.7.15-r2
2.7.15-r3
2.7.15-r4
2.7.16-r0
2.7.16-r1
2.7.16-r2

Alpine:v3.11 / python2

Package

Name
python2
Purl
pkg:apk/alpine/python2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.18-r0

Affected versions

2.*

2.6.1-r0
2.6.1-r1
2.6.1-r2
2.6.2-r0
2.6.2-r1
2.6.3-r0
2.6.4-r0
2.6.5-r0
2.6.5-r1
2.6.5-r2
2.6.5-r3
2.6.5-r4
2.6.5-r5
2.6.5-r6
2.6.5-r7
2.6.5-r8
2.7.2-r0
2.7.2-r2
2.7.2-r3
2.7.3-r3
2.7.3-r4
2.7.3-r5
2.7.5-r0
2.7.5-r1
2.7.5-r2
2.7.5-r3
2.7.6-r0
2.7.6-r1
2.7.6-r2
2.7.6-r3
2.7.6-r4
2.7.7-r0
2.7.8-r0
2.7.9-r0
2.7.9-r1
2.7.9-r2
2.7.9-r3
2.7.9-r4
2.7.10-r0
2.7.10-r1
2.7.10-r2
2.7.10-r3
2.7.11-r0
2.7.11-r1
2.7.11-r2
2.7.11-r3
2.7.11-r4
2.7.11-r5
2.7.12-r0
2.7.12-r1
2.7.12-r2
2.7.12-r3
2.7.12-r4
2.7.12-r5
2.7.12-r6
2.7.12-r7
2.7.13-r0
2.7.13-r1
2.7.13-r2
2.7.14-r0
2.7.14-r1
2.7.14-r2
2.7.14-r3
2.7.14-r4
2.7.15-r0
2.7.15-r1
2.7.15-r2
2.7.15-r3
2.7.15-r4
2.7.16-r0
2.7.16-r1
2.7.16-r2
2.7.16-r3

Alpine:v3.12 / python2

Package

Name
python2
Purl
pkg:apk/alpine/python2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.18-r0

Affected versions

2.*

2.6.1-r0
2.6.1-r1
2.6.1-r2
2.6.2-r0
2.6.2-r1
2.6.3-r0
2.6.4-r0
2.6.5-r0
2.6.5-r1
2.6.5-r2
2.6.5-r3
2.6.5-r4
2.6.5-r5
2.6.5-r6
2.6.5-r7
2.6.5-r8
2.7.2-r0
2.7.2-r2
2.7.2-r3
2.7.3-r3
2.7.3-r4
2.7.3-r5
2.7.5-r0
2.7.5-r1
2.7.5-r2
2.7.5-r3
2.7.6-r0
2.7.6-r1
2.7.6-r2
2.7.6-r3
2.7.6-r4
2.7.7-r0
2.7.8-r0
2.7.9-r0
2.7.9-r1
2.7.9-r2
2.7.9-r3
2.7.9-r4
2.7.10-r0
2.7.10-r1
2.7.10-r2
2.7.10-r3
2.7.11-r0
2.7.11-r1
2.7.11-r2
2.7.11-r3
2.7.11-r4
2.7.11-r5
2.7.12-r0
2.7.12-r1
2.7.12-r2
2.7.12-r3
2.7.12-r4
2.7.12-r5
2.7.12-r6
2.7.12-r7
2.7.13-r0
2.7.13-r1
2.7.13-r2
2.7.14-r0
2.7.14-r1
2.7.14-r2
2.7.14-r3
2.7.14-r4
2.7.15-r0
2.7.15-r1
2.7.15-r2
2.7.15-r3
2.7.15-r4
2.7.16-r0
2.7.16-r1
2.7.16-r2
2.7.16-r3
2.7.17-r0
2.7.17-r1
2.7.17-r2
2.7.17-r3
2.7.17-r4

Alpine:v3.9 / python2

Package

Name
python2
Purl
pkg:apk/alpine/python2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.18-r0

Affected versions

2.*

2.6.1-r0
2.6.1-r1
2.6.1-r2
2.6.2-r0
2.6.2-r1
2.6.3-r0
2.6.4-r0
2.6.5-r0
2.6.5-r1
2.6.5-r2
2.6.5-r3
2.6.5-r4
2.6.5-r5
2.6.5-r6
2.6.5-r7
2.6.5-r8
2.7.2-r0
2.7.2-r2
2.7.2-r3
2.7.3-r3
2.7.3-r4
2.7.3-r5
2.7.5-r0
2.7.5-r1
2.7.5-r2
2.7.5-r3
2.7.6-r0
2.7.6-r1
2.7.6-r2
2.7.6-r3
2.7.6-r4
2.7.7-r0
2.7.8-r0
2.7.9-r0
2.7.9-r1
2.7.9-r2
2.7.9-r3
2.7.9-r4
2.7.10-r0
2.7.10-r1
2.7.10-r2
2.7.10-r3
2.7.11-r0
2.7.11-r1
2.7.11-r2
2.7.11-r3
2.7.11-r4
2.7.11-r5
2.7.12-r0
2.7.12-r1
2.7.12-r2
2.7.12-r3
2.7.12-r4
2.7.12-r5
2.7.12-r6
2.7.12-r7
2.7.13-r0
2.7.13-r1
2.7.13-r2
2.7.14-r0
2.7.14-r1
2.7.14-r2
2.7.14-r3
2.7.14-r4
2.7.15-r0
2.7.15-r1
2.7.15-r2
2.7.15-r3
2.7.16-r0
2.7.16-r1
2.7.16-r2

Debian:11 / python2.7

Package

Name
python2.7
Purl
pkg:deb/debian/python2.7?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.18~rc1-1

Ecosystem specific 

{
    "urgency": "unimportant"
}

Git / github.com/python/cpython

Affected ranges

Type
GIT
Repo
https://github.com/python/cpython
Events
Introduced
1bf9cc509326bc42cd8cb1650eb9bf64550d817e
Fixed
4b47a5b6ba66b02df9392feb97b8ead916f8c1fa