An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker con...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:Pro:14.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.6+esm2"}]}]

Ubuntu:Pro:14.04:LTS python3.4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1ubuntu1~14.04.7+esm2"}]}]

Ubuntu:Pro:14.04:LTS python3.5

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"}]}]

Ubuntu:16.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.8"}]}]

Ubuntu:16.04:LTS python3.5

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.8"}]}]

Ubuntu:18.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.15-4ubuntu4~18.04.1"}]}]

Ubuntu:18.04:LTS python3.6

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-1~18.04.2"}]}]

参照URL

advisory ubuntu.com
advisory ubuntu.com
advisory ubuntu.com
report ubuntu.com
report python-security.readthedocs.io
report cve.org