CVE-2019-18348

MediumCVSS 6.1/10Last modified Oct 14, 2026

Description

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2019
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-183499.8HotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp.CVE-2019-18354.4A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an authenticated, local attacker to access sensitive information CVE-2019-183506.1In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of CVE-2019-183528.2Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using CVE-2019-183559.8An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.CVE-2019-183566.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).CVE-2019-183576.1An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).CVE-2019-183595.5A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. The vulnerability causes an application crash, which leads CVE-2019-18367.1A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow CVE-2019-183605.3In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.CVE-2019-183615.3JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.CVE-2019-183625.3JetBrains MPS before 2019.2.2 exposed listening ports to the network.