Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1yNjRxLXc4anItZzlxcM3wRw
Improper Neutralization of CRLF Sequences in urllib3 library for Python
In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.
Permalink: https://github.com/advisories/GHSA-r64q-w8jr-g9qpJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNjRxLXc4anItZzlxcM3wRw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 6 months ago
CVSS Score: 6.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-r64q-w8jr-g9qp, CVE-2019-11236
References:
- https://nvd.nist.gov/vuln/detail/CVE-2019-11236
- https://github.com/urllib3/urllib3/issues/1553
- https://access.redhat.com/errata/RHSA-2019:2272
- https://access.redhat.com/errata/RHSA-2019:3335
- https://access.redhat.com/errata/RHSA-2019:3590
- https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/
- https://usn.ubuntu.com/3990-1/
- https://usn.ubuntu.com/3990-2/
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html
- https://github.com/advisories/GHSA-r64q-w8jr-g9qp
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-132.yaml
- https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
Blast Radius: 34.3
Affected Packages
pypi:urllib3
Dependent packages: 3,966Dependent repositories: 422,295
Downloads: 513,562,492 last month
Affected Version Ranges: <= 1.24.2
Fixed in: 1.24.3
All affected versions: 0.3.1, 0.4.0, 0.4.1, 1.0.1, 1.0.2, 1.2.1, 1.2.2, 1.7.1, 1.8.2, 1.8.3, 1.9.1, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.13.1, 1.15.1, 1.18.1, 1.19.1, 1.21.1, 1.24.1, 1.24.2
All unaffected versions: 1.24.3, 1.25.1, 1.25.2, 1.25.3, 1.25.4, 1.25.5, 1.25.6, 1.25.7, 1.25.8, 1.25.9, 1.25.10, 1.25.11, 1.26.0, 1.26.1, 1.26.2, 1.26.3, 1.26.4, 1.26.5, 1.26.6, 1.26.7, 1.26.8, 1.26.9, 1.26.10, 1.26.11, 1.26.12, 1.26.13, 1.26.14, 1.26.15, 1.26.16, 1.26.17, 1.26.18, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.1.0, 2.2.0, 2.2.1