CVE-2019-18348

🗓️ 23 Oct 2019 16:31:22Reported by Debian Security Bug TrackerType

debiancve🔗 security-tracker.debian.org👁 58 Views

An issue discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0 enables CRLF injection with a control of a URL parameter, similar to CVE-2019-9740 and CVE-2019-9947. Fixed in various versions

Reporter	Title	Published	Views	Family All 201
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak	18 Oct 202214:58	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Python affects IBM Operations Analytics Predictive Insights (CVE-2019-18348)	12 Mar 202013:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Open Source Python affects IBM Tivoli Application Dependency Discovery Manager (CVE-2019-18348)	16 Sep 202016:06	–	ibm
FreeBSD	Python -- multiple vulnerabilities	19 Aug 202000:00	–	freebsd
FreeBSD	Python -- multiple vulnerabilities	24 Oct 201900:00	–	freebsd
FreeBSD	Python -- CRLF injection via the host part of the url passed to urlopen()	24 Oct 201900:00	–	freebsd
Amazon	Medium: python27	3 Jun 202000:00	–	amazon
Amazon	Medium: python27, python34, python35, python36	29 Jul 202000:00	–	amazon
Amazon	Medium: python36	31 Aug 202000:00	–	amazon

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	any	python2.7	2.7.18~rc1-1	python2.7_2.7.18~rc1-1_any.deb

23 Oct 2019 16:31Current

7.8High risk

Vulners AI Score7.8

CVSS 24.3

CVSS 3.16.1

EPSS0.03513