Improper Neutralization of CRLF Sequences in urllib3 library for Python
In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-11236US | medium6.1 | — | ||
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.htmlWEB
- https://access.redhat.com/errata/RHSA-2019:2272WEB
- https://access.redhat.com/errata/RHSA-2019:3335WEB
- https://access.redhat.com/errata/RHSA-2019:3590WEB
- https://github.com/advisories/GHSA-r64q-w8jr-g9qpADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-132.yamlWEB
- https://github.com/urllib3/urllib3PACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan