PT-2019-5897 · Python +4 · Python +4

Name of the Vulnerable Software and Affected Versions: Python affected versions not specified Description: The issue is related to a CRLF injection vulnerability in the urllib2 module of the Python programming language. This could allow a remote attacker to impact data integrity. Recommendations:...

IBM Cloud Orchestrator CVE-2019-4396 CRLF Injection Vulnerability

Description IBM Cloud Orchestrator is prone to a CRLF-injection vulnerability. An attacker can exploit this issue to add arbitrary headers to a webpage. This may aid in further attacks. The following versions are vulnerable: IBM Cloud Orchestrator 2.5, 2.5.0.1, 2.5.0.2, 2.5.0.3, 2.5.0.4, 2.5.0.5,...

GHSA-MVQP-Q37C-WF9J io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' Versions of Ratpack 0.9.1 through and including 1.7.4 are vulnerable to HTTP Response Splitting, if untrusted and unsanitized data is used to populate the headers of an HTTP response. An attacker can...

NewStart CGSL CORE 5.04 / MAIN 5.04 : python Multiple Vulnerabilities (NS-SA-2019-0187)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python packages installed that are affected by multiple vulnerabilities: - Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of servic...

X (Formerly Twitter): Creating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMs

Summary When composing a tweet or a direct message it is possible to use a new line character %0d to seperate two URLs within the actual hyperlinking process, but not the URL displaying process. The new line character acts as an invisible character that disrupts the actual hyperlinking process,...

CVE-2019-9741

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command...

UBUNTU-CVE-2019-17420

In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the httpheader signature to not alert on a response with a single \r\n ending...

CVE-2007-4400

CRLF injection vulnerability in the included media script in Konversation allows user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file...

CVE-2008-3906

CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string...

HTTP Response Splitting

webrick is vulnerable to HTTP response splitting. Lack of sanitization in the HTTP headers allow an attacker to inject CRLF characters and cause users to render malicious content. The exploit is possible when the application parses untrusted user input into an HTTP header in the response...

HTTP response splitting in WEBrick (Additional fix)

If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This is the same issue as CVE-2017-17742. The previous fix was incomplete, which addressed the...

USN-4127-1: Python vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only...

SUSE-SU-2019:2399-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663. - CVE-2018-20060: Remove Authorization header when redirecting cross-host bsc1119376...

SUSE-SU-2019:2391-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11324: Fixed invalid CA certificat verification bsc1132900. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663...

openSUSE Security Update : python-urllib3 (openSUSE-2019-2133)

This update for python-urllib3 fixes the following issues : Security issues fixed : - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11324: Fixed invalid CA certificat verification bsc1132900. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663. This update w...

openSUSE: Security Advisory for python-urllib3 (openSUSE-SU-2019:2131-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for python-urllib3 (moderate)

openSUSE Security Update: Security update for python-urllib3 Announcement ID: openSUSE-SU-2019:2133-1 Rating: moderate References: 1129071 1132663 1132900 Cross-References: CVE-2019-11236 CVE-2019-11324 CVE-2019-9740 Affected Products: openSUSE Leap 15.1 An update that fixes three vulnerabilities...

OPENSUSE-SU-2019:2133-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11324: Fixed invalid CA certificat verification bsc1132900. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663. This update was...

OPENSUSE-SU-2019:2131-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: Security issues fixed: - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11324: Fixed invalid CA certificat verification bsc1132900. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663. - CVE-2018-2006...

Security update for python-urllib3 (moderate)

openSUSE Security Update: Security update for python-urllib3 Announcement ID: openSUSE-SU-2019:2131-1 Rating: moderate References: 1119376 1129071 1132663 1132900 Cross-References: CVE-2018-20060 CVE-2019-11236 CVE-2019-11324 CVE-2019-9740 Affected Products: openSUSE Leap 15.0 An update that fixe...