CVE-2019-11236
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
02 / AFFECTED SOFTWARE
Affected packages
33 explicit affected versions
49 explicit affected versions
49 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
05 / REFERENCES
Further evidence
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html
- https://access.redhat.com/errata/RHSA-2019:2272
- https://access.redhat.com/errata/RHSA-2019:3335
- https://access.redhat.com/errata/RHSA-2019:3590
- https://github.com/urllib3/urllib3/issues/1553
- https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/
- https://usn.ubuntu.com/3990-1/
- https://usn.ubuntu.com/3990-2/
- https://github.com/advisories/GHSA-r64q-w8jr-g9qp
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-132.yaml
- https://github.com/urllib3/urllib3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72
- https://lists.fedoraproject.org/archives/list/[email protected]/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2
- https://nvd.nist.gov/vuln/detail/CVE-2019-11236
- https://usn.ubuntu.com/3990-1
- https://usn.ubuntu.com/3990-2
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/