CRLF Injection Vulnerability in Python Packages: CVE-2019-9740
Summary
UBUNTU-CVE-2019-9740: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm2. Fixed in 2.7.6-8ubuntu0.6+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The affected packages, including python2.7, python3.4, python3.5, and others, are essential for running Python applications. These packages provide core functionalities for Python development, including libraries for web requests and data manipulation. The vulnerability identified as CVE-2019-9740 affects these packages, allowing attackers to exploit the urllib2 and urllib modules, leading to potential security breaches.
Vulnerability Detail
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF (Carriage Return Line Feed) injection is possible if an attacker controls a URL parameter. This can be exploited by injecting \r\n in the query string after a '?' character, potentially leading to the execution of arbitrary HTTP headers or Redis commands. The vulnerability poses a risk of unauthorized access and data manipulation, making it critical to address.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user-controlled input in URL parameters when making requests with urllib or urllib2. Validate and sanitize all inputs to prevent potential CRLF injection attacks.
Conclusion
CVE-2019-9740 is a significant vulnerability affecting multiple Python packages, allowing for CRLF injection through user-controlled URL parameters. It is crucial to update the affected packages to their patched versions to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2019-9740 is a vulnerability in Python's urllib2 and urllib modules that allows CRLF injection through manipulated URL parameters.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and execution of arbitrary commands.
Yes, patched versions of the affected packages are available. Updating to these versions will mitigate the vulnerability.
You can use Vulert to monitor your application for vulnerabilities by simply providing a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
