CVE-2022-0391

NameCVE-2022-0391
DescriptionA flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3575-1, DLA-3966-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pypy3 (PTS)bullseye7.3.5+dfsg-2+deb11u2vulnerable
bullseye (security)7.3.5+dfsg-2+deb11u4fixed
bookworm7.3.11+dfsg-2+deb12u2fixed
sid, trixie7.3.17+dfsg-3fixed
python2.7 (PTS)bullseye2.7.18-8+deb11u1fixed
python3.9 (PTS)bullseye3.9.2-1vulnerable
bullseye (security)3.9.2-1+deb11u2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pypy3sourcebullseye7.3.5+dfsg-2+deb11u4DLA-3966-1
pypy3source(unstable)7.3.6+dfsg-1
python2.7sourcebuster2.7.16-2+deb10u3DLA-3575-1
python2.7sourcebullseye2.7.18-8+deb11u1
python2.7source(unstable)(unfixed)
python3.4source(unstable)(unfixed)
python3.5source(unstable)(unfixed)
python3.7source(unstable)(unfixed)
python3.9source(unstable)3.9.7-1

Notes

[bullseye] - python3.9 <no-dsa> (Minor issue)
[buster] - python3.7 <ignored> (Minor issue, different approach to sanitization; regressions reports)
[buster] - pypy3 <no-dsa> (Minor issue)
https://bugs.python.org/issue43882
Regressions reported for django, boto-core and cloud-init
Fixed by: https://github.com/python/cpython/commit/76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 (v3.10.0b1)
Followup for 3.10.x: https://github.com/python/cpython/commit/24f1d1a8a2c4aa58a606b4b6d5fa4305a3b91705 (v3.10.0b2)
Fixed by: https://github.com/python/cpython/commit/491fde0161d5e527eeff8586dd3972d7d3a631a7 (v3.9.5)
Followup for 3.9.x: https://github.com/python/cpython/commit/8a595744e696a0fb92dccc5d4e45da41571270a1 (v3.9.6)
Fixed by: https://github.com/python/cpython/commit/515a7bc4e13645d0945b46a8e1d9102b918cd407 (v3.8.11)
Fixed by: https://github.com/python/cpython/commit/f4dac7ec55477a6c5d965e594e74bd6bda786903 (v3.7.11)
Fixed by: https://github.com/python/cpython/commit/6c472d3a1d334d4eeb4a25eba7bf3b01611bf667 (v3.6.14)

Search for package or bug name: Reporting problems