A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
Se ha encontrado un fallo en Python, concretamente en el módulo urllib.parse. Este módulo ayuda a dividir las cadenas de localizadores de recursos uniformes (URL) en componentes. El problema involucra como el método urlparse no sanea la entrada y permite caracteres como "\r" y "\n" en la ruta de la URL. Este fallo permite a un atacante introducir una URL diseñada, conllevando a ataques de inyección. Este fallo afecta a Python versiones anteriores a 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 y 3.6.14
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
AV:N/AC:L/Au:N/C:N/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-74
|
| [email protected] | Primary |
en
CWE-74
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| python | python | * | <built-in method update of dict object at 0x7fd30864edc0> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd340a41940> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd340a41b00> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd340a41640> | Application |
| python | python | 3.10.0 | <built-in method update of dict object at 0x7fd30864c380> | Application |
| python | python | 3.10.0 | <built-in method update of dict object at 0x7fd30864c6c0> | Application |
| python | python | 3.10.0 | <built-in method update of dict object at 0x7fd340a401c0> | Application |
| python | python | 3.10.0 | <built-in method update of dict object at 0x7fd36b1cf280> | Application |
| python | python | 3.10.0 | <built-in method update of dict object at 0x7fd360690580> | Application |
| python | python | 3.10.0 | <built-in method update of dict object at 0x7fd30864cd80> | Application |
| netapp | active_iq_unified_manager | - | <built-in method update of dict object at 0x7fd340a43640> | Application |
| netapp | hci | - | <built-in method update of dict object at 0x7fd340a40d00> | Application |
| netapp | management_services_for_element_software | - | <built-in method update of dict object at 0x7fd360693580> | Application |
| netapp | ontap_select_deploy_administration_utility | - | <built-in method update of dict object at 0x7fd3606915c0> | Application |
| netapp | solidfire\,_enterprise_sds_\&_hci_storage_node | - | <built-in method update of dict object at 0x7fd36b85eb00> | Application |
| netapp | hci_compute_node | - | <built-in method update of dict object at 0x7fd36b85e280> | Hardware |
| fedoraproject | fedora | 34 | <built-in method update of dict object at 0x7fd36b85f180> | Operating System |
| fedoraproject | fedora | 35 | <built-in method update of dict object at 0x7fd36b85d0c0> | Operating System |
| oracle | http_server | 12.2.1.3.0 | <built-in method update of dict object at 0x7fd34bb7e380> | Application |
| oracle | http_server | 12.2.1.4.0 | <built-in method update of dict object at 0x7fd34bb7f300> | Application |
| oracle | zfs_storage_appliance_kit | 8.8 | <built-in method update of dict object at 0x7fd34bb7c7c0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.10.0:alpha1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.10.0:alpha2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.10.0:alpha3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.10.0:alpha4:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.10.0:alpha5:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.10.0:alpha6:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* |
| Yes | cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* |