CVE-2019-11236

Published: Apr 15, 2019Modified: Jun 17, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Affected (1)

Products: Python: Urllib3

Python

1 product

Urllib3

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Urllib3	Up to 1.24.2

Related CWEs

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References (30)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2019:2272

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2019:3335

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2019:3590

Source: cve@mitre.org

https://github.com/urllib3/urllib3/issues/1553

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/

Source: cve@mitre.org

https://usn.ubuntu.com/3990-1/

Source: cve@mitre.org

https://usn.ubuntu.com/3990-2/

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html