EIQ-2019-0021

EIQ-2019-0021

CVE-2019-11236

CRLF injection and HTTP header manipulation in urllib3

22 Apr 2019

2 - MEDIUM

6.1

2.4.0

An attacker could inject Carriage Return Line Feed (CRLF) sequences in a targeted system by exploiting improper neutralization of CRLF sequences in urllib3.
An attacker with control of the urllib request address parameter could exploit this vulnerability by injecting CRLF sequences in the targeted system.

A successful exploit could allow manipulating HTTP headers, and enabling additional attack methods.
To exploit this vulnerability, an attacker must send malicious requests to the targeted system.

Upgrade urllib3 to version 1.24.3, 1.25.2, or later.

Restrict network access from untrusted sources to make it more difficult to exploit the vulnerability.

2.3.4 and earlier

For more information, see:

• GitHub issue about CRLF injection

• Python bug tracker issue about CRLF injection

• Snyk report about CVE-2019-11236