← Back

CVE-2022-0391

nvd nist
Published: Feb 9, 2022Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Affected (21)

Show all products
Python: Python · Netapp: Active Iq Unified Manager, Hci, Hci Compute Node, Management Services For Element Software, Ontap Select Deploy Administration Utility, Solidfire, Enterprise Sds & Hci Storage Node · Fedoraproject: Fedora · Oracle: Http Server, Zfs Storage Appliance Kit
Python
1 product
Python
Netapp
6 products
Active Iq Unified Manager
Hci
Hci Compute Node
Management Services For Element Software
Ontap Select Deploy Administration Utility
Solidfire, Enterprise Sds & Hci Storage Node
Fedoraproject
1 product
Fedora
Oracle
2 products
Http Server
Zfs Storage Appliance Kit
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Python
Python
Before 3.6.14
Python
From 3.7.0 to 3.7.11
Python
From 3.8.0 to 3.8.11
Python
From 3.9.0 to 3.9.5
Python
Version 3.10.0 alpha1
Python
Version 3.10.0 alpha2
Python
Version 3.10.0 alpha3
Python
Version 3.10.0 alpha4
Python
Version 3.10.0 alpha5
Python
Version 3.10.0 alpha6
Configuration B
6 vulnerable
Vulnerable SoftwareAffected Versions
Active Iq Unified Manager
All versions
Hci
All versions
Hci Compute Node
All versions
Management Services For Element Software
All versions
Ontap Select Deploy Administration Utility
All versions
Solidfire, Enterprise Sds & Hci Storage Node
All versions
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 34
Fedora
Version 35
Configuration D
3 vulnerable
Vulnerable SoftwareAffected Versions
Oracle
Http Server
Version 12.2.1.3.0
Http Server
Version 12.2.1.4.0
Zfs Storage Appliance Kit
Version 8.8

Related CWEs

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (16)

Source: secalert@redhat.com
ExploitIssue TrackingPatchVendor Advisory
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.