CVE-2019-9740 Other in n/a

What is CVE-2019-9740?

CVE-2019-9740 is a medium-severity vulnerability in Python Python, published on 13 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Weakness: CWE-93

Which versions are affected by CVE-2019-9740?

It affects 1 product.

Products include Python Python.

How do I fix CVE-2019-9740?

Upgrade to a fixed version.

Is CVE-2019-9740 being exploited?

There is no known exploitation of CVE-2019-9740 in the wild and no public exploit code.

Other vulnerabilities in Python Python

• CVE-2008-5031 Integer overflow in n/a Critical 10.0
• CVE-2014-4650 Path traversal in n/a Critical 9.8
• CVE-2016-5636 Integer overflow in n/a Critical 9.8
• CVE-2007-4559 Path traversal in n/a Critical 9.8
• CVE-2017-17522 Command injection in n/a High 8.8

All Python Python vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-9740, GHSA-p3j2-v862-h3v3, PSF-2019-10, UBUNTU-CVE-2019-9740, openSUSE-SU-2024:11204-1, openSUSE-SU-2024:14128-1 and 1 more.