Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1yNjRxLXc4anItZzlxcM3wRw

Improper Neutralization of CRLF Sequences in urllib3 library for Python

In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.

Permalink: https://github.com/advisories/GHSA-r64q-w8jr-g9qp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNjRxLXc4anItZzlxcM3wRw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 6 months ago


CVSS Score: 6.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-r64q-w8jr-g9qp, CVE-2019-11236
References: Repository: https://github.com/urllib3/urllib3
Blast Radius: 34.3

Affected Packages

pypi:urllib3
Dependent packages: 3,966
Dependent repositories: 422,295
Downloads: 513,562,492 last month
Affected Version Ranges: <= 1.24.2
Fixed in: 1.24.3
All affected versions: 0.3.1, 0.4.0, 0.4.1, 1.0.1, 1.0.2, 1.2.1, 1.2.2, 1.7.1, 1.8.2, 1.8.3, 1.9.1, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.13.1, 1.15.1, 1.18.1, 1.19.1, 1.21.1, 1.24.1, 1.24.2
All unaffected versions: 1.24.3, 1.25.1, 1.25.2, 1.25.3, 1.25.4, 1.25.5, 1.25.6, 1.25.7, 1.25.8, 1.25.9, 1.25.10, 1.25.11, 1.26.0, 1.26.1, 1.26.2, 1.26.3, 1.26.4, 1.26.5, 1.26.6, 1.26.7, 1.26.8, 1.26.9, 1.26.10, 1.26.11, 1.26.12, 1.26.13, 1.26.14, 1.26.15, 1.26.16, 1.26.17, 1.26.18, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.1.0, 2.2.0, 2.2.1