Python urllib vulnerabilities

The urllib.request.DataHandler module in Python parses user-controlled data URLs, allowing header injection through newlines in the data URL mediatype.

In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the path component of a URL that lacks a ? character, followed by an HTTP header or a Redis command. This is similar to CVE-2019-9740 and is fixed in later Python versions.

In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the query string (after a ? character) followed by an HTTP header or a Redis command. The issue is fixed in later Python versions.

The HTTPPasswordMgr class in the urllib.request module and its subclasses did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for https:// were also used for http:// requests, allowing cleartext capture.

In urllib2 (Python 2.x through 2.7.17) and urllib (Python 3.x through 3.8.0), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the host component of a URL followed by an HTTP header. This is similar to CVE-2019-9740 and CVE-2019-9947 and is fixed in later Python versions.