CRLF Injection

2020-08-0621:34:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

1419

0.004 Low

EPSS

Percentile

72.0%

JSON

urllib2 in python2 is vulnerable to CRLF injection. The vulnerability exists if an attacker controls a URL parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This vulnerability is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue.

CPENameOperatorVersion
python2:3.10eq2.7.16-r2
python2:3.11eq2.7.16-r3
python2-tkinter:3.10eq2.7.16-r0
python3.7:eoaneq3.7.5~rc1-2
python3.8:focaleq3.8.2-1ubuntu1
python2.7:bioniceq2.7.15~rc1-1
python3.5:xenialeq3.5.1-10
python2.7:xenialeq2.7.11-7ubuntu1
python3.6:bioniceq3.6.5-3
rh-python36-python-pipeq9.0.1__2.el6

Name	Operator	Version
python2:3.10	eq	2.7.16-r2
python2:3.11	eq	2.7.16-r3
python2-tkinter:3.10	eq	2.7.16-r0
python3.7:eoan	eq	3.7.5~rc1-2
python3.8:focal	eq	3.8.2-1ubuntu1
python2.7:bionic	eq	2.7.15~rc1-1
python3.5:xenial	eq	3.5.1-10
python2.7:xenial	eq	2.7.11-7ubuntu1
python3.6:bionic	eq	3.6.5-3
rh-python36-python-pip	eq	9.0.1__2.el6