Python CVE-2019-9947 CRLF Injection Vulnerability

Bugtraq ID:	107555
Class:	Input Validation Error
CVE:	CVE-2019-9947
Remote:	Yes
Local:	No
Published:	Feb 06 2019 12:00AM
Updated:	Feb 06 2019 12:00AM
Credit:	push0ebp
Vulnerable:	Python Software Foundation Python 3.7.2 Python Software Foundation Python 3.7.1 Python Software Foundation Python 3.6.8 Python Software Foundation Python 3.6.7 Python Software Foundation Python 3.6.6 Python Software Foundation Python 3.6.5 Python Software Foundation Python 3.6.4 Python Software Foundation Python 3.6.3 Python Software Foundation Python 3.6.2 Python Software Foundation Python 3.6.1 Python Software Foundation Python 3.6 Python Software Foundation Python 3.5.6 Python Software Foundation Python 3.5.5 Python Software Foundation Python 3.5.4 Python Software Foundation Python 3.5.3 Python Software Foundation Python 3.5.2 Python Software Foundation Python 3.5.1 Python Software Foundation Python 3.5 Python Software Foundation Python 3.4.9 Python Software Foundation Python 3.4.8 Python Software Foundation Python 3.4.7 Python Software Foundation Python 3.4.6 Python Software Foundation Python 3.4.5 Python Software Foundation Python 3.4.4 Python Software Foundation Python 3.4.3 Python Software Foundation Python 3.4.2 Python Software Foundation Python 3.4.1 Python Software Foundation Python 3.4 Python Software Foundation Python 3.3.3 Python Software Foundation Python 3.3 Python Software Foundation Python 3.2.3 Python Software Foundation Python 3.2.2 Python Software Foundation Python 3.1.1 Python Software Foundation Python 3.0.1 Python Software Foundation Python 2.7.16 Python Software Foundation Python 2.7.15 Python Software Foundation Python 2.7.14 Python Software Foundation Python 2.7.12 Python Software Foundation Python 2.7.11 Python Software Foundation Python 2.7.10 Python Software Foundation Python 2.7.9 Python Software Foundation Python 2.7.8 Python Software Foundation Python 2.7.7 Python Software Foundation Python 2.7.6 Python Software Foundation Python 2.7.3 Python Software Foundation Python 2.7.2 Python Software Foundation Python 2.7 Python Software Foundation Python 2.6.5 Python Software Foundation Python 2.6.2 Python Software Foundation Python 2.5.6 Python Software Foundation Python 2.5.5 Python Software Foundation Python 2.5.3 Python Software Foundation Python 2.5.2 Python Software Foundation Python 2.5.1 Python Software Foundation Python 2.4.5 Python Software Foundation Python 2.4.4 Python Software Foundation Python 2.4.3 + Trustix Secure Linux 3.0.5 Python Software Foundation Python 2.4.2 Python Software Foundation Python 2.4.1 Python Software Foundation Python 2.4 Python Software Foundation Python 2.3.6 Python Software Foundation Python 2.3.5 Python Software Foundation Python 2.3.4 Python Software Foundation Python 2.3.3 Python Software Foundation Python 2.3.2 Python Software Foundation Python 2.3.1 Python Software Foundation Python 2.3 Python Software Foundation Python 2.2.3 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 Python Software Foundation Python 2.2.2 + OpenPKG OpenPKG 1.2 + OpenPKG OpenPKG 1.2 + Redhat Linux 7.3 + Redhat Linux 7.3 + S.u.S.E. Linux Personal 8.2 + S.u.S.E. Linux Personal 8.2 Python Software Foundation Python 2.2.1 Python Software Foundation Python 2.2 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 Python Software Foundation Python 2.1.3 + Debian Linux 3.0 Python Software Foundation Python 2.1.2 Python Software Foundation Python 2.1.1 Python Software Foundation Python 2.1 Python Software Foundation Python 2.0.1 Python Software Foundation Python 2.0 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 Python Software Foundation Python 3.7.0 Python Software Foundation Python 3.5 Python Software Foundation Python 3.4 Python Software Foundation Python 3.3.4 Python Software Foundation Python 3.3.2 Python Software Foundation Python 3.3.1 Python Software Foundation Python 3.3 Python Software Foundation Python 3.2.6 Python Software Foundation Python 3.2.5 Python Software Foundation Python 3.2.4 Python Software Foundation Python 3.2.2150 Python Software Foundation Python 3.2.1 Python Software Foundation Python 3.2.0 Python Software Foundation Python 3.2 Python Software Foundation Python 3.1.5 Python Software Foundation Python 3.1.4 Python Software Foundation Python 3.1.3 Python Software Foundation Python 3.1.2 Python Software Foundation Python 3.1 Python Software Foundation Python 2.7.5 Python Software Foundation Python 2.7.4 Python Software Foundation Python 2.7.13 Python Software Foundation Python 2.7.1 Python Software Foundation Python 2.7 Python Software Foundation Python 2.6.8 Python Software Foundation Python 2.6.7 Python Software Foundation Python 2.6.6 Python Software Foundation Python 2.6 Python Software Foundation Python 2.5.150 Python Software Foundation Python 2.5 Python Software Foundation Python 2.4.2 Python Software Foundation Python 2.4 Python Software Foundation Python 2.3 Python Software Foundation Python 2.2
Not Vulnerable:

Python CVE-2019-9947 CRLF Injection Vulnerability

Python is prone to a CRLF-injection vulnerability.

An attacker can exploit this issue to add arbitrary headers to a webpage. This may aid in further attacks.

Python 2.x through 2.7.16 and Python 3.x through 3.7.2 are vulnerable.

Python CVE-2019-9947 CRLF Injection Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Python CVE-2019-9947 CRLF Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Python CVE-2019-9947 CRLF Injection Vulnerability

References:

• Header Injection in urllib (Python)
  
• python home page (python)