CVE-2022-0391 Other in python
Attackers can inject CRLF characters into URLs via the urllib.parse module, potentially leading to injection attacks in applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0391?
CVE-2022-0391 is a high-severity vulnerability in Fedoraproject Fedora, published on 9 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
Weakness: CWE-74
Which versions are affected by CVE-2022-0391?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 10 products.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.6.14, 3.7.11, 3.8.11, 3.9.5 |
python Bitnami | All versions | 3.6.14, 3.7.11, 3.8.11, 3.9.5 |
python-min Bitnami | All versions | 3.6.14, 3.7.11, 3.8.11, 3.9.5 |
Linux distribution packages (1)
python openSUSE:Tumbleweed | All versions | 2.7.18-16.1 |
Products include Fedoraproject Fedora, Netapp Active Iq Unified Manager, Netapp Hci, Netapp Hci Compute Node, Netapp Management Services for Element Software, Netapp Ontap Select Deploy Administration Utility and 4 more.
How do I fix CVE-2022-0391?
Upgrade libpython to a fixed version for your release line: 3.6.14, 3.7.11, 3.8.11 or 3.9.5.
Is CVE-2022-0391 being exploited?
There is no known exploitation of CVE-2022-0391 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-109641, BIT-libpython-2022-0391, BIT-python-2022-0391, BIT-python-min-2022-0391, CLSA-2022-1646665957, CLSA-2022-1646666442 and 7 more.