CVE-2019-9947

    Dashboard / Vulnerabilities / CVE-2019-9947

    CVE-2019-9947

    Published: 23 Mar 2019Last Modified: 7 Aug 2026

    Summary:

    Details: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

    References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/, http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html, http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html, http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html, http://www.openwall.com/lists/oss-security/2021/02/04/2, https://access.redhat.com/errata/RHSA-2019:1260, https://access.redhat.com/errata/RHSA-2019:2030, https://access.redhat.com/errata/RHSA-2019:3335, https://access.redhat.com/errata/RHSA-2019:3520, https://access.redhat.com/errata/RHSA-2019:3725, https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html, https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html, https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html, https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html, https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html, https://security.gentoo.org/glsa/202003-26, https://security.netapp.com/advisory/ntap-20190404-0004/, https://usn.ubuntu.com/4127-1/, https://usn.ubuntu.com/4127-2/, https://bugs.python.org/issue35906

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c2f86d86e6c8f5fd1ef602128b537a48f3f5c063

    Affected versions

    v3.5.8rc2
    v3.5.8rc1
    v3.5.7
    v3.5.7rc1
    v3.5.6
    v3.5.6rc1
    v3.5.5
    v3.5.5rc1
    v3.5.4
    v3.5.4rc1
    v3.5.3
    v3.5.3rc1
    v3.5.2
    v3.5.2rc1
    v3.5.1rc1
    v3.5.0rc3
    v3.5.0rc2
    v3.5.0rc1
    v3.5.0b4
    v3.5.0b3
    v3.5.0b1
    v3.5.0a4
    v3.5.0a3
    v3.5.0a2
    v3.5.0a1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High