A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
03 May 2023, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Jun 2022, 21:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* |
20 Apr 2022, 00:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Apr 2022, 17:03
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
|
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/ - Mailing List, Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/ - Mailing List, Third Party Advisory | |
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220225-0009/ - Third Party Advisory |
25 Feb 2022, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Feb 2022, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Feb 2022, 22:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://bugs.python.org/issue43882 - Exploit, Issue Tracking, Patch, Vendor Advisory | |
| CWE | CWE-74 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CPE | cpe:2.3:a:python:python:3.10.0:alpha5:*:*:*:*:*:* cpe:2.3:a:python:python:*:*:*:*:*:*:*:* cpe:2.3:a:python:python:3.10.0:alpha1:*:*:*:*:*:* cpe:2.3:a:python:python:3.10.0:alpha2:*:*:*:*:*:* cpe:2.3:a:python:python:3.10.0:alpha6:*:*:*:*:*:* cpe:2.3:a:python:python:3.10.0:alpha4:*:*:*:*:*:* cpe:2.3:a:python:python:3.10.0:alpha3:*:*:*:*:*:* |
09 Feb 2022, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-09 23:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-0391
Mitre link : CVE-2022-0391
CVE.ORG link : CVE-2022-0391
JSON object : View
Products Affected
oracle
- zfs_storage_appliance_kit
- http_server
netapp
- active_iq_unified_manager
- management_services_for_element_software
- solidfire\,_enterprise_sds_\&_hci_storage_node
- ontap_select_deploy_administration_utility
- hci_compute_node
- hci
python
- python
fedoraproject
- fedora
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')