CVE-2019-11236 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.1 MEDIUM	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 68%

Vendor	Product	Version
python	urllib3	𝑥 ≤ 1.24.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

python-urllib3

bullseye	1.26.5-1~exp1 fixed
bookworm	1.26.12-1 fixed
sid	2.0.7-2 fixed
trixie	2.0.7-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

python-urllib3

disco	Fixed 1.24.1-1ubuntu0.1 released
cosmic	Fixed 1.22-1ubuntu0.18.10.1 released
bionic	Fixed 1.22-1ubuntu0.18.04.1 released
xenial	Fixed 1.13.1-2ubuntu0.16.04.3 released
trusty	Fixed 1.7.1-1ubuntu4.1+esm1 released

Known Exploits!

Common Weakness Enumeration

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html

https://access.redhat.com/errata/RHSA-2019:2272

https://access.redhat.com/errata/RHSA-2019:3335

https://access.redhat.com/errata/RHSA-2019:3590

https://github.com/urllib3/urllib3/issues/1553

https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html

https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html

https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/

https://usn.ubuntu.com/3990-1/

https://usn.ubuntu.com/3990-2/