An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-python-psycopg2-docalma-upgrade-python2-attrsalma-upgrade-python2-chardetalma-upgrade-python2-coveragealma-upgrade-python2-cythonalma-upgrade-python2-dnsalma-upgrade-python2-docsalma-upgrade-python2-docs-infoalma-upgrade-python2-docutilsalma-upgrade-python2-funcsigsalma-upgrade-python2-idnaalma-upgrade-python2-ipaddressalma-upgrade-python2-markupsafealma-upgrade-python2-mockalma-upgrade-python2-pluggyalma-upgrade-python2-psycopg2alma-upgrade-python2-psycopg2-debugalma-upgrade-python2-psycopg2-testsalma-upgrade-python2-pyalma-upgrade-python2-pymysqlalma-upgrade-python2-pysocksalma-upgrade-python2-pytestalma-upgrade-python2-pytest-mockalma-upgrade-python2-pytzalma-upgrade-python2-pyyamlalma-upgrade-python2-rpm-macrosalma-upgrade-python2-setuptools_scm | May 4, 2022 | Mar 13, 2019 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-python3amazon-linux-ami-2-upgrade-python3-debugamazon-linux-ami-2-upgrade-python3-debuginfoamazon-linux-ami-2-upgrade-python3-develamazon-linux-ami-2-upgrade-python3-libsamazon-linux-ami-2-upgrade-python3-testamazon-linux-ami-2-upgrade-python3-tkinteramazon-linux-ami-2-upgrade-python3-tools | Apr 27, 2020 | Mar 13, 2019 | |
| Amazon_linux | — | amazon-linux-upgrade-python27amazon-linux-upgrade-python34amazon-linux-upgrade-python35amazon-linux-upgrade-python36 | Jun 30, 2019 | Mar 12, 2019 |
| Centos_linux | — | centos-upgrade-babelcentos-upgrade-cython-debugsourcecentos-upgrade-numpy-debugsourcecentos-upgrade-platform-pythoncentos-upgrade-platform-python-debugcentos-upgrade-platform-python-develcentos-upgrade-pythoncentos-upgrade-python-coverage-debugsourcecentos-upgrade-python-debugcentos-upgrade-python-debuginfocentos-upgrade-python-develcentos-upgrade-python-libscentos-upgrade-python-lxml-debugsourcecentos-upgrade-python-nose-docscentos-upgrade-python-psycopg2-debuginfocentos-upgrade-python-psycopg2-debugsourcecentos-upgrade-python-psycopg2-doccentos-upgrade-python-pymongo-debuginfocentos-upgrade-python-pymongo-debugsourcecentos-upgrade-python-sqlalchemy-doccentos-upgrade-python-testcentos-upgrade-python-toolscentos-upgrade-python2centos-upgrade-python2-attrscentos-upgrade-python2-babelcentos-upgrade-python2-backportscentos-upgrade-python2-backports-ssl_match_hostnamecentos-upgrade-python2-bsoncentos-upgrade-python2-bson-debuginfocentos-upgrade-python2-chardetcentos-upgrade-python2-coveragecentos-upgrade-python2-coverage-debuginfocentos-upgrade-python2-cythoncentos-upgrade-python2-cython-debuginfocentos-upgrade-python2-debugcentos-upgrade-python2-debuginfocentos-upgrade-python2-debugsourcecentos-upgrade-python2-develcentos-upgrade-python2-dnscentos-upgrade-python2-docscentos-upgrade-python2-docs-infocentos-upgrade-python2-docutilscentos-upgrade-python2-funcsigscentos-upgrade-python2-idnacentos-upgrade-python2-ipaddresscentos-upgrade-python2-jinja2centos-upgrade-python2-libscentos-upgrade-python2-lxmlcentos-upgrade-python2-lxml-debuginfocentos-upgrade-python2-markupsafecentos-upgrade-python2-mockcentos-upgrade-python2-nosecentos-upgrade-python2-numpycentos-upgrade-python2-numpy-debuginfocentos-upgrade-python2-numpy-doccentos-upgrade-python2-numpy-f2pycentos-upgrade-python2-pipcentos-upgrade-python2-pip-wheelcentos-upgrade-python2-pluggycentos-upgrade-python2-psycopg2centos-upgrade-python2-psycopg2-debugcentos-upgrade-python2-psycopg2-debug-debuginfocentos-upgrade-python2-psycopg2-debuginfocentos-upgrade-python2-psycopg2-testscentos-upgrade-python2-pycentos-upgrade-python2-pygmentscentos-upgrade-python2-pymongocentos-upgrade-python2-pymongo-debuginfocentos-upgrade-python2-pymongo-gridfscentos-upgrade-python2-pymysqlcentos-upgrade-python2-pysockscentos-upgrade-python2-pytestcentos-upgrade-python2-pytest-mockcentos-upgrade-python2-pytzcentos-upgrade-python2-pyyamlcentos-upgrade-python2-pyyaml-debuginfocentos-upgrade-python2-requestscentos-upgrade-python2-rpm-macroscentos-upgrade-python2-scipycentos-upgrade-python2-scipy-debuginfocentos-upgrade-python2-setuptoolscentos-upgrade-python2-setuptools-wheelcentos-upgrade-python2-setuptools_scmcentos-upgrade-python2-sixcentos-upgrade-python2-sqlalchemycentos-upgrade-python2-testcentos-upgrade-python2-tkintercentos-upgrade-python2-toolscentos-upgrade-python2-urllib3centos-upgrade-python2-virtualenvcentos-upgrade-python2-wheelcentos-upgrade-python2-wheel-wheelcentos-upgrade-python3-debuginfocentos-upgrade-python3-debugsourcecentos-upgrade-python3-idlecentos-upgrade-python3-libscentos-upgrade-python3-testcentos-upgrade-python3-tkintercentos-upgrade-pyyaml-debugsourcecentos-upgrade-scipy-debugsourcecentos-upgrade-tkinter | Aug 28, 2019 | Mar 13, 2019 |
| Debian | debian-upgrade-python2-7 | Jun 26, 2019 | Mar 13, 2019 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jun 17, 2026 | Aug 21, 2025 | |
| Freebsd | freebsd-upgrade-package-python37freebsd-upgrade-package-python36 | Jul 12, 2019 | Jul 12, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-lang-python | Mar 16, 2020 | Mar 13, 2019 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-python-urllib3 | Dec 4, 2019 | Mar 13, 2019 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-pythonhuawei-euleros-2_0_sp3-upgrade-python-develhuawei-euleros-2_0_sp3-upgrade-python-libshuawei-euleros-2_0_sp3-upgrade-tkinter | Nov 19, 2019 | Mar 13, 2019 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-pythonhuawei-euleros-2_0_sp5-upgrade-python-develhuawei-euleros-2_0_sp5-upgrade-python-libshuawei-euleros-2_0_sp5-upgrade-tkinter | Nov 19, 2019 | Mar 13, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-python3huawei-euleros-2_0_sp8-upgrade-python3-libshuawei-euleros-2_0_sp8-upgrade-python3-test | Jun 27, 2019 | Mar 13, 2019 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-library-python-tkinter-27-2-7-16-0-175-3-36-0-26-0oracle-solaris-11-3-upgrade-library-python-tkinter-34-3-4-10-0-175-3-36-0-26-0oracle-solaris-11-3-upgrade-runtime-python-27-2-7-16-0-175-3-36-0-26-0oracle-solaris-11-3-upgrade-runtime-python-27-tests-2-7-16-0-175-3-36-0-26-0oracle-solaris-11-3-upgrade-runtime-python-34-3-4-10-0-175-3-36-0-26-0oracle-solaris-11-4-upgrade-library-python-tkinter-27-2-7-16-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-library-python-tkinter-34-3-4-10-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-library-python-tkinter-35-3-5-7-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-library-python-tkinter-37-3-7-4-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-27-2-7-16-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-27-tests-2-7-16-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-34-3-4-10-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-35-3-5-7-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-runtime-python-37-3-7-4-11-4-12-0-1-3-0oracle-solaris-11-4-upgrade-text-gnu-gettext-0-20-1-11-4-21-0-1-69-0 | Aug 21, 2019 | Mar 13, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-babeloracle-linux-upgrade-platform-pythonoracle-linux-upgrade-platform-python-debugoracle-linux-upgrade-platform-python-develoracle-linux-upgrade-pythonoracle-linux-upgrade-python2oracle-linux-upgrade-python2-attrsoracle-linux-upgrade-python2-babeloracle-linux-upgrade-python2-backportsoracle-linux-upgrade-python2-backports-ssl-match-hostnameoracle-linux-upgrade-python2-bsonoracle-linux-upgrade-python2-chardetoracle-linux-upgrade-python2-coverageoracle-linux-upgrade-python2-cythonoracle-linux-upgrade-python2-debugoracle-linux-upgrade-python2-develoracle-linux-upgrade-python2-dnsoracle-linux-upgrade-python2-docsoracle-linux-upgrade-python2-docs-infooracle-linux-upgrade-python2-docutilsoracle-linux-upgrade-python2-funcsigsoracle-linux-upgrade-python2-idnaoracle-linux-upgrade-python2-ipaddressoracle-linux-upgrade-python2-jinja2oracle-linux-upgrade-python2-libsoracle-linux-upgrade-python2-lxmloracle-linux-upgrade-python2-markupsafeoracle-linux-upgrade-python2-mockoracle-linux-upgrade-python2-noseoracle-linux-upgrade-python2-numpyoracle-linux-upgrade-python2-numpy-docoracle-linux-upgrade-python2-numpy-f2pyoracle-linux-upgrade-python2-piporacle-linux-upgrade-python2-pip-wheeloracle-linux-upgrade-python2-pluggyoracle-linux-upgrade-python2-psycopg2oracle-linux-upgrade-python2-psycopg2-debugoracle-linux-upgrade-python2-psycopg2-testsoracle-linux-upgrade-python2-pyoracle-linux-upgrade-python2-pygmentsoracle-linux-upgrade-python2-pymongooracle-linux-upgrade-python2-pymongo-gridfsoracle-linux-upgrade-python2-pymysqloracle-linux-upgrade-python2-pysocksoracle-linux-upgrade-python2-pytestoracle-linux-upgrade-python2-pytest-mockoracle-linux-upgrade-python2-pytzoracle-linux-upgrade-python2-pyyamloracle-linux-upgrade-python2-requestsoracle-linux-upgrade-python2-rpm-macrosoracle-linux-upgrade-python2-scipyoracle-linux-upgrade-python2-setuptoolsoracle-linux-upgrade-python2-setuptools-scmoracle-linux-upgrade-python2-setuptools-wheeloracle-linux-upgrade-python2-sixoracle-linux-upgrade-python2-sqlalchemyoracle-linux-upgrade-python2-testoracle-linux-upgrade-python2-tkinteroracle-linux-upgrade-python2-toolsoracle-linux-upgrade-python2-urllib3oracle-linux-upgrade-python2-virtualenvoracle-linux-upgrade-python2-wheeloracle-linux-upgrade-python2-wheel-wheeloracle-linux-upgrade-python3-idleoracle-linux-upgrade-python3-libsoracle-linux-upgrade-python3-testoracle-linux-upgrade-python3-tkinteroracle-linux-upgrade-python-debugoracle-linux-upgrade-python-develoracle-linux-upgrade-python-libsoracle-linux-upgrade-python-nose-docsoracle-linux-upgrade-python-psycopg2-docoracle-linux-upgrade-python-sqlalchemy-docoracle-linux-upgrade-python-testoracle-linux-upgrade-python-toolsoracle-linux-upgrade-tkinter | Jul 21, 2020 | Mar 13, 2019 |
| Redhat_linux | redhat-upgrade-babelredhat-upgrade-cython-debugsourceredhat-upgrade-numpy-debugsourceredhat-upgrade-platform-pythonredhat-upgrade-platform-python-debugredhat-upgrade-platform-python-develredhat-upgrade-pythonredhat-upgrade-python-coverage-debugsourceredhat-upgrade-python-debugredhat-upgrade-python-debuginforedhat-upgrade-python-develredhat-upgrade-python-libsredhat-upgrade-python-lxml-debugsourceredhat-upgrade-python-nose-docsredhat-upgrade-python-psycopg2-debuginforedhat-upgrade-python-psycopg2-debugsourceredhat-upgrade-python-psycopg2-docredhat-upgrade-python-pymongo-debuginforedhat-upgrade-python-pymongo-debugsourceredhat-upgrade-python-sqlalchemy-docredhat-upgrade-python-testredhat-upgrade-python-toolsredhat-upgrade-python2redhat-upgrade-python2-attrsredhat-upgrade-python2-babelredhat-upgrade-python2-backportsredhat-upgrade-python2-backports-ssl_match_hostnameredhat-upgrade-python2-bsonredhat-upgrade-python2-bson-debuginforedhat-upgrade-python2-chardetredhat-upgrade-python2-coverageredhat-upgrade-python2-coverage-debuginforedhat-upgrade-python2-cythonredhat-upgrade-python2-cython-debuginforedhat-upgrade-python2-debugredhat-upgrade-python2-debuginforedhat-upgrade-python2-debugsourceredhat-upgrade-python2-develredhat-upgrade-python2-dnsredhat-upgrade-python2-docsredhat-upgrade-python2-docs-inforedhat-upgrade-python2-docutilsredhat-upgrade-python2-funcsigsredhat-upgrade-python2-idnaredhat-upgrade-python2-ipaddressredhat-upgrade-python2-jinja2redhat-upgrade-python2-libsredhat-upgrade-python2-lxmlredhat-upgrade-python2-lxml-debuginforedhat-upgrade-python2-markupsaferedhat-upgrade-python2-mockredhat-upgrade-python2-noseredhat-upgrade-python2-numpyredhat-upgrade-python2-numpy-debuginforedhat-upgrade-python2-numpy-docredhat-upgrade-python2-numpy-f2pyredhat-upgrade-python2-pipredhat-upgrade-python2-pip-wheelredhat-upgrade-python2-pluggyredhat-upgrade-python2-psycopg2redhat-upgrade-python2-psycopg2-debugredhat-upgrade-python2-psycopg2-debug-debuginforedhat-upgrade-python2-psycopg2-debuginforedhat-upgrade-python2-psycopg2-testsredhat-upgrade-python2-pyredhat-upgrade-python2-pygmentsredhat-upgrade-python2-pymongoredhat-upgrade-python2-pymongo-debuginforedhat-upgrade-python2-pymongo-gridfsredhat-upgrade-python2-pymysqlredhat-upgrade-python2-pysocksredhat-upgrade-python2-pytestredhat-upgrade-python2-pytest-mockredhat-upgrade-python2-pytzredhat-upgrade-python2-pyyamlredhat-upgrade-python2-pyyaml-debuginforedhat-upgrade-python2-requestsredhat-upgrade-python2-rpm-macrosredhat-upgrade-python2-scipyredhat-upgrade-python2-scipy-debuginforedhat-upgrade-python2-setuptoolsredhat-upgrade-python2-setuptools-wheelredhat-upgrade-python2-setuptools_scmredhat-upgrade-python2-sixredhat-upgrade-python2-sqlalchemyredhat-upgrade-python2-testredhat-upgrade-python2-tkinterredhat-upgrade-python2-toolsredhat-upgrade-python2-urllib3redhat-upgrade-python2-virtualenvredhat-upgrade-python2-wheelredhat-upgrade-python2-wheel-wheelredhat-upgrade-python3-debuginforedhat-upgrade-python3-debugsourceredhat-upgrade-python3-idleredhat-upgrade-python3-libsredhat-upgrade-python3-testredhat-upgrade-python3-tkinterredhat-upgrade-pyyaml-debugsourceredhat-upgrade-scipy-debugsourceredhat-upgrade-tkinter | Aug 7, 2019 | Mar 13, 2019 | |
| Rocky_linux | rocky-upgrade-cython-debugsourcerocky-upgrade-python-coverage-debugsourcerocky-upgrade-python-psycopg2-debuginforocky-upgrade-python-psycopg2-debugsourcerocky-upgrade-python-psycopg2-docrocky-upgrade-python-pymongo-debuginforocky-upgrade-python-pymongo-debugsourcerocky-upgrade-python2-bsonrocky-upgrade-python2-bson-debuginforocky-upgrade-python2-coveragerocky-upgrade-python2-coverage-debuginforocky-upgrade-python2-cythonrocky-upgrade-python2-cython-debuginforocky-upgrade-python2-markupsaferocky-upgrade-python2-psycopg2rocky-upgrade-python2-psycopg2-debugrocky-upgrade-python2-psycopg2-debug-debuginforocky-upgrade-python2-psycopg2-debuginforocky-upgrade-python2-psycopg2-testsrocky-upgrade-python2-pymongorocky-upgrade-python2-pymongo-debuginforocky-upgrade-python2-pymongo-gridfsrocky-upgrade-python2-pyyamlrocky-upgrade-python2-pyyaml-debuginforocky-upgrade-python2-scipyrocky-upgrade-python2-scipy-debuginforocky-upgrade-pyyaml-debugsourcerocky-upgrade-scipy-debugsource | Mar 12, 2024 | Mar 13, 2019 | |
| Suse | — | suse-upgrade-python-urllib3suse-upgrade-python2-urllib3suse-upgrade-python2-urllib3-testsuse-upgrade-python3-cherrypysuse-upgrade-python3-urllib3suse-upgrade-python3-urllib3-test | Sep 17, 2019 | Mar 12, 2019 |
| Ubuntu | ubuntu-pro-upgrade-python2-7ubuntu-pro-upgrade-python2-7-minimalubuntu-pro-upgrade-python3-11ubuntu-pro-upgrade-python3-11-minimalubuntu-pro-upgrade-python3-4ubuntu-pro-upgrade-python3-4-minimalubuntu-pro-upgrade-python3-5ubuntu-pro-upgrade-python3-5-minimalubuntu-pro-upgrade-python3-6ubuntu-pro-upgrade-python3-6-minimalubuntu-pro-upgrade-python3-7ubuntu-pro-upgrade-python3-7-minimalubuntu-pro-upgrade-python3-8ubuntu-pro-upgrade-python3-8-minimalubuntu-pro-upgrade-python3-9ubuntu-pro-upgrade-python3-9-minimalubuntu-upgrade-python2-7ubuntu-upgrade-python2-7-minimalubuntu-upgrade-python3-10ubuntu-upgrade-python3-10-minimalubuntu-upgrade-python3-11ubuntu-upgrade-python3-11-minimalubuntu-upgrade-python3-12ubuntu-upgrade-python3-12-minimalubuntu-upgrade-python3-5ubuntu-upgrade-python3-5-minimalubuntu-upgrade-python3-6ubuntu-upgrade-python3-6-minimalubuntu-upgrade-python3-7ubuntu-upgrade-python3-7-minimalubuntu-upgrade-python3-8ubuntu-upgrade-python3-8-minimal | Sep 10, 2019 | Mar 12, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Mar 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub