6.1 CVE-2019-9740
Enriched by CISA Exploit
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with rn (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
https://nvd.nist.gov/vuln/detail/CVE-2019-9740
Categories
CWE-93 : Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Avoid using CRLF as a special sequence. Appropriately filter or quote CRLF sequences in user-controlled input. CRLF injection enables spam proxy (add mail headers) using email address or name. CRLF injection in API function arguments modify headers for outgoing requests. Spoofed entries in web server log file via carriage returns Chain: inject fake log entries with fake timestamps using CRLF injection Chain: Application accepts CRLF in an object ID, allowing HTTP response splitting. Chain: HTTP response splitting via CRLF in parameter related to URL.
References
af854a3a-2127-422b-91ae-364da2661108 Exploit
cve@mitre.org Exploit
AFFECTED (from MITRE)
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a |
|
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. | ||
CPE
| cpe | start | end |
|---|---|---|
| Configuration 1 | ||
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | >= 2.0 | < 2.7.17 |
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | >= 3.5.0 | < 3.5.8 |
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | >= 3.6.0 | < 3.6.9 |
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | >= 3.7.0 | < 3.7.4 |
REMEDIATION
EXPLOITS
Exploit-db.com
| id | description | date | |
|---|---|---|---|
| No known exploits | |||
POC Github
| Url |
|---|
| No known exploits |
Other Nist (github, ...)
| Url |
|---|
| https://bugs.python.org/issue36276 |
| https://bugs.python.org/issue36276 |
CAPEC
Common Attack Pattern Enumerations and Classifications
| id | description | severity |
|---|---|---|
| 15 | Command Delimiters |
High |
| 81 | Web Server Logs Tampering |
High |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
