CRLF Injection Vulnerability in urllib3 Package
Summary
CVE-2019-11236: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. Affects python-urllib3 across 2 version ranges.
< 1.25.6-4
< 1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1
Fixed in 1.25.6-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python that provides features such as connection pooling, client-side SSL/TLS verification, and support for HTTP/1.1 and HTTP/2. This library is widely used in various applications to facilitate HTTP requests. However, versions up to 1.24.1 are susceptible to a CRLF (Carriage Return Line Feed) injection vulnerability, which can be exploited if an attacker controls the request parameters.
Vulnerability Detail
The vulnerability, identified as CVE-2019-11236, allows an attacker to inject CRLF sequences into HTTP headers, potentially leading to HTTP response splitting. This can enable the attacker to manipulate the response sent to the client, leading to various attacks such as cache poisoning or cross-site scripting (XSS). The issue arises from improper handling of user-controlled input in the request parameters, which can be exploited by crafting malicious requests.
How To Fix
Minimum fixed version
1.25.6-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider sanitizing user inputs to prevent CRLF injection by validating and encoding any user-controlled data before it is included in HTTP headers.
Conclusion
The CRLF injection vulnerability in the urllib3 package poses significant risks to applications that utilize this library. It is crucial for developers to upgrade to the patched version to safeguard against potential attacks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python-urllib3 →
FAQ
CRLF injection is a type of attack that involves injecting CRLF characters into HTTP headers, which can lead to various security issues such as response splitting.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploiting this vulnerability can lead to HTTP response splitting, which may allow attackers to manipulate responses, perform cache poisoning, or execute cross-site scripting attacks.
Yes, upgrading to version 1.25.6-4 or later will resolve this vulnerability.
Yes, you can use the Vulert playground to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for python-urllib3.
