High severity · published Feb 9, 2022
CVE-2022-0391
A flaw was found in Python, specifically within the urllib.parse module
7.5
CVSS
8.5%
EPSS
No
On KEV
Description
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python ·
python 3.10.0b1, python 3.9.5, python 3.8.11, python 3.7.11, python 3.6.14 · source: vendor, NVD
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
FE
Fedora · Fedoraproject
34; 35 · source: NVD
HC
Hci · Netapp
All versions, or not specified · source: NVD
HC
Hci Compute Node · Netapp
All versions, or not specified · source: NVD
HS
Http Server · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
MS
Management Services For Element Software · Netapp
All versions, or not specified · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
SE
Solidfire, Enterprise Sds & Hci Storage Node · Netapp
All versions, or not specified · source: NVD
ZS
Zfs Storage Appliance Kit · Oracle
8.8 · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-0391
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-0391
Exploit
https://bugs.python.org/issue43882
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/
security.gentoo.org
https://security.gentoo.org/glsa/202305-02
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220225-0009/
More from python
7.5
CVE-2020-10735
A flaw was found in python
7.5
CVE-2021-3737
A flaw was found in python
7.5
CVE-2019-5010
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6
6.5
CVE-2021-3733
There's a flaw in urllib's AbstractBasicAuthHandler class
5.7
CVE-2021-3426
There's a flaw in Python 3's pydoc