Python CVE-2019-9740 CRLF Injection Vulnerability

Bugtraq ID:	107466
Class:	Input Validation Error
CVE:	CVE-2019-9740
Remote:	Yes
Local:	No
Published:	Mar 12 2019 12:00AM
Updated:	Mar 12 2019 12:00AM
Credit:	Guo Xi chen & Jiang Hang from SANGFOR Technologies Co. LTD
Vulnerable:	Redhat Gluster Storage 3.0 Python Software Foundation Python 3.7.2 Python Software Foundation Python 3.7.1 Python Software Foundation Python 3.6.8 Python Software Foundation Python 3.6.7 Python Software Foundation Python 3.6.6 Python Software Foundation Python 3.6.5 Python Software Foundation Python 3.6.4 Python Software Foundation Python 3.6.3 Python Software Foundation Python 3.6.2 Python Software Foundation Python 3.6.1 Python Software Foundation Python 3.6 Python Software Foundation Python 3.5.6 Python Software Foundation Python 3.5.5 Python Software Foundation Python 3.5.4 Python Software Foundation Python 3.5.3 Python Software Foundation Python 3.5.2 Python Software Foundation Python 3.5.1 Python Software Foundation Python 3.5 Python Software Foundation Python 3.4.9 Python Software Foundation Python 3.4.8 Python Software Foundation Python 3.4.7 Python Software Foundation Python 3.4.6 Python Software Foundation Python 3.4.5 Python Software Foundation Python 3.4.4 Python Software Foundation Python 3.4.3 Python Software Foundation Python 3.4.2 Python Software Foundation Python 3.4.1 Python Software Foundation Python 3.4 Python Software Foundation Python 3.3.3 Python Software Foundation Python 3.3 Python Software Foundation Python 3.2.3 Python Software Foundation Python 3.2.2 Python Software Foundation Python 3.1.1 Python Software Foundation Python 3.0.1 Python Software Foundation Python 2.7.16 Python Software Foundation Python 2.7.15 Python Software Foundation Python 2.7.14 Python Software Foundation Python 2.7.12 Python Software Foundation Python 2.7.11 Python Software Foundation Python 2.7.10 Python Software Foundation Python 2.7.9 Python Software Foundation Python 2.7.8 Python Software Foundation Python 2.7.7 Python Software Foundation Python 2.7.6 Python Software Foundation Python 2.7.3 Python Software Foundation Python 2.7.2 Python Software Foundation Python 2.7 Python Software Foundation Python 2.6.5 Python Software Foundation Python 2.6.2 Python Software Foundation Python 2.5.6 Python Software Foundation Python 2.5.5 Python Software Foundation Python 2.5.3 Python Software Foundation Python 2.5.2 Python Software Foundation Python 2.5.1 Python Software Foundation Python 2.4.5 Python Software Foundation Python 2.4.4 Python Software Foundation Python 2.4.3 + Trustix Secure Linux 3.0.5 Python Software Foundation Python 2.4.2 Python Software Foundation Python 2.4.1 Python Software Foundation Python 2.4 Python Software Foundation Python 2.3.6 Python Software Foundation Python 2.3.5 Python Software Foundation Python 2.3.4 Python Software Foundation Python 2.3.3 Python Software Foundation Python 2.3.2 Python Software Foundation Python 2.3.1 Python Software Foundation Python 2.3 Python Software Foundation Python 2.2.3 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 Python Software Foundation Python 2.2.2 + OpenPKG OpenPKG 1.2 + OpenPKG OpenPKG 1.2 + Redhat Linux 7.3 + Redhat Linux 7.3 + S.u.S.E. Linux Personal 8.2 + S.u.S.E. Linux Personal 8.2 Python Software Foundation Python 2.2.1 Python Software Foundation Python 2.2 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 Python Software Foundation Python 2.1.3 + Debian Linux 3.0 Python Software Foundation Python 2.1.2 Python Software Foundation Python 2.1.1 Python Software Foundation Python 2.1 Python Software Foundation Python 2.0.1 Python Software Foundation Python 2.0 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 Python Software Foundation Python 3.7.0 Python Software Foundation Python 3.5 Python Software Foundation Python 3.4 Python Software Foundation Python 3.3.4 Python Software Foundation Python 3.3.2 Python Software Foundation Python 3.3.1 Python Software Foundation Python 3.3 Python Software Foundation Python 3.2.6 Python Software Foundation Python 3.2.5 Python Software Foundation Python 3.2.4 Python Software Foundation Python 3.2.2150 Python Software Foundation Python 3.2.1 Python Software Foundation Python 3.2.0 Python Software Foundation Python 3.2 Python Software Foundation Python 3.1.5 Python Software Foundation Python 3.1.4 Python Software Foundation Python 3.1.3 Python Software Foundation Python 3.1.2 Python Software Foundation Python 3.1 Python Software Foundation Python 2.7.5 Python Software Foundation Python 2.7.4 Python Software Foundation Python 2.7.13 Python Software Foundation Python 2.7.1 Python Software Foundation Python 2.7 Python Software Foundation Python 2.6.8 Python Software Foundation Python 2.6.7 Python Software Foundation Python 2.6.6 Python Software Foundation Python 2.6 Python Software Foundation Python 2.5.150 Python Software Foundation Python 2.5 Python Software Foundation Python 2.4.2 Python Software Foundation Python 2.4 Python Software Foundation Python 2.3 Python Software Foundation Python 2.2
Not Vulnerable:

Python CVE-2019-9740 CRLF Injection Vulnerability

Python is prone to a CRLF-injection vulnerability.

An attacker can exploit this issue to add arbitrary headers to a webpage. This may aid in further attacks.

Python 2.x through 2.7.16 and Python 3.x through 3.7.2 are vulnerable.

Python CVE-2019-9740 CRLF Injection Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Python CVE-2019-9740 CRLF Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Python CVE-2019-9740 CRLF Injection Vulnerability

References:

• python home page (python)
  
• Python urllib CRLF injection vulnerability (Python)
  
• Python urllib CRLF injection vulnerability (Python)
  
• Bug 1688169 CVE-2019-9740 python-urllib3: CRLF injection in urllib3 (Redhat)
  
• CVE-2019-9740 (Redhat)