IM
IronMonkey Threat Research

CVE-2019-18348 MEDIUM

Published: 2019-10-23 | Last Modified: 2026-10-07 | Status: Modified

Description

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

Additional Descriptions (1)

Se detectó un problema en urllib2 en Python versiones 2.x hasta 2.7.17 y urllib en Python versiones 3.x hasta 3.8.0. La inyección de CRLF es posible si el atacante controla un parámetro url, como es demostrado por el primer argumento para urllib.request.urlopen con \ r\n (específicamente en el componente host de una URL) seguido de un encabezado HTTP. Esto es similar al problema de la cadena de consulta de CVE-2019-9740 y al problema de la cadena de ruta de CVE-2019-9947. (Esto no es explotable cuando glibc tiene corregido el CVE-2016-10739). Esto está corregido en las versiones: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1

CVSS Metrics

Base Score: 6.1 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeCHANGED
Confidentiality ImpactLOW
Integrity ImpactLOW
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 2.7

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactPARTIAL
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-74
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-74

Affected Products

Vendor Product Version Update Type
python python * <built-in method update of dict object at 0x7fd384e11800> Application
python python * <built-in method update of dict object at 0x7fd3840e4600> Application
python python * <built-in method update of dict object at 0x7fd369f82640> Application
python python * <built-in method update of dict object at 0x7fd512b69dc0> Application
python python * <built-in method update of dict object at 0x7fd384e114c0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

References