Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Python Improper Neutralization of CRLF Sequences (CRLF Injection) Vulnerability - CVE-2019-9947 - Vulnerability Database
Python

Python Improper Neutralization of CRLF Sequences (CRLF Injection) Vulnerability - CVE-2019-9947

Medium
Reference: CVE-2019-9947
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-9947
Title: Python Improper Neutralization of CRLF Sequences (CRLF Injection) Vulnerability
Overview:

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter as demonstrated by the first argument to urllib.request.urlopen with rn (specifically in the path component of a URL that lacks a character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.