CRLF Injection Vulnerability in Python Packages: CVE-2019-18348
Summary
UBUNTU-CVE-2019-18348: An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm5. Fixed in 2.7.6-8ubuntu0.6+esm5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is extensively used for web development, data analysis, artificial intelligence, and more. The affected packages, including python2.7, python3.4, python3.5, python3.6, python3.7, and python3.8, are integral to various applications and libraries, providing essential functionalities for developers. The vulnerability in question arises from the urllib2 and urllib modules, which handle URL requests and responses.
Vulnerability Detail
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if an attacker controls a URL parameter, allowing them to inject CRLF characters (\r\n) into HTTP headers. This vulnerability can lead to HTTP response splitting, which may allow an attacker to manipulate the response sent to the client, potentially leading to data leakage or other malicious actions. The vulnerability is similar to previous issues identified in CVE-2019-9740 and CVE-2019-9947.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, consider validating and sanitizing URL inputs to prevent CRLF characters from being injected. Implementing strict input validation can help mitigate the risk of this vulnerability until a proper update can be applied.
Conclusion
The CRLF injection vulnerability (CVE-2019-18348) in various Python packages poses a significant risk, allowing attackers to manipulate HTTP responses. It is crucial to update the affected packages to their patched versions to mitigate this risk. Additionally, using input validation can serve as a temporary measure until updates are applied.
See every vulnerability recorded for python2.7 →
FAQ
CRLF injection is a type of attack where an attacker can inject CRLF (Carriage Return and Line Feed) characters into HTTP headers, potentially manipulating the response sent to clients.
The vulnerability affects Python 2.x versions up to 2.7.17 and Python 3.x versions up to 3.8.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 6.1, indicating a medium severity level.
If you cannot update the packages, ensure to validate and sanitize URL inputs to prevent CRLF characters from being injected as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
