CVEvulnerability

CVE-2022-0391

7.5 HIGH Published 2022-02-09 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2022-02-09
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-74

Description

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Affected configurations

• python python (< 3.6.14) • python python (>= 3.7.0 < 3.7.11) • python python (>= 3.8.0 < 3.8.11) • python python (>= 3.9.0 < 3.9.5) • python python 3.10.0 • netapp active iq unified manager • netapp hci • netapp management services for element software • netapp ontap select deploy administration utility • netapp solidfire\, enterprise sds \& hci storage node • netapp hci compute node • fedoraproject fedora 34 • fedoraproject fedora 35 • oracle http server 12.2.1.3.0 • oracle http server 12.2.1.4.0 • oracle zfs storage appliance kit 8.8

Related

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References