Skip to content
Log inStart free trial

PYSEC-2019-62

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Not rated yet Withdrawn Mar 14, 2023 PyPI
Severity
Not rated yet
No source has published a CVSS score yet
Exploit chance (EPSS)
—
No score published
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
1.24.3
Upgrade urllib3 to this version or later

Description

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Affected versions

PyPI

PackageVulnerableFixed in
urllib3
< 1.24.3
1.24.3

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

urllib3 PyPI → 1.24.3

pip
pip install --upgrade "urllib3>=1.24.3"
poetry
poetry add "urllib3>=1.24.3"
uv
uv add "urllib3>=1.24.3"

References

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Withdrawn
AdvisorySeverityWhy it's related
GHSA-vxq7-64xx-v4gw
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
High Also affects urllib3
GHSA-gh4c-6fx4-qh6g
urllib3: Chunked Deflate streaming can enter an infinite loop
Medium Also affects urllib3
GHSA-8988-9cw3-xx77
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
High Also affects urllib3
GHSA-mf9v-mfxr-j63j
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
High Also affects urllib3
GHSA-qccp-gfcp-xxvc
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
High Also affects urllib3
GHSA-38jv-5279-wg99
Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
High Also affects urllib3
GHSA-2xpw-w6gg-jr37
urllib3 streaming API improperly handles highly compressed data
High Also affects urllib3
GHSA-gm62-xv2j-4w53
urllib3 allows an unbounded number of links in the decompression chain
High Also affects urllib3
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor