First Last Prev Next    This bug is not in your last search results.
Bug 1155094 - (CVE-2019-18348) VUL-0: CVE-2019-18348: python,python36,python3,python27: CRLF injection via the host part of the url passed to urlopen()
(CVE-2019-18348)
VUL-0: CVE-2019-18348: python,python36,python3,python27: CRLF injection via t...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/245655/
CVSSv3.1:SUSE:CVE-2019-18348:6.1:(AV...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2019-10-25 11:24 UTC by Alexandros Toptsoglou
Modified: 2022-06-10 08:40 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2019-10-25 11:24:06 UTC 
CVE-2019-18348

An issue was discovered in urllib/urllib2 in Python. CRLF injection is possible if the attacker controls the host part of the url parameter passed to urlopen().

The fix for CVE-2019-9947 is ineffective if the glibc version used by python is still affected by CVE-2016-10739. The original fix for CVE-2019-9947 only checked the part of the URL after the port (e.g. in "http://server:7777/my/path?query" only "/my/path?query" was checked for invalid characters) so if an attacker can control the hostname part he is still able to inject HTTP headers. Due to CVE-2016-10739, getaddrinfo() resolves an invalid hostname as a valid one, so the URL can contain CLRF sequences and, at the same time, it can be resolved to a valid host.


Reference:
https://bugs.python.org/issue30458#msg347282

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1727276
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18348
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18348.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348
https://bugs.python.org/issue30458#msg347282
Comment 1 Matej Cepl 2019-12-04 18:42:34 UTC 
A separate issue just for this CVE has been opened upstream https://bugs.python.org/issue38576 .
Comment 2 Matej Cepl 2019-12-04 18:45:07 UTC 
See https://bugzilla.redhat.com/show_bug.cgi?id=1727276#c6 (comments 6 and 7):

> This issue affects the versions of python and python3 as shipped with Red Hat Enterprise Linux 7, however users running Red Hat Enterprise Linux 7.7 and above are not vulnerable because glibc flaw CVE-2016-10739 was fixed in RHSA-2019:2118-03, which makes this bug not exploitable.

> This flaw can be exploited only when glibc flaw CVE-2016-10739 is not fixed, as it requires getaddrinfo() function to resolve an invalid hostname, containing control characters like the CRLF sequence, as a valid one.

What is the status of CVE-2016-10739 in the individual SUSE distributions, and which exact channels are affected by this?
Comment 8 Matej Cepl 2020-03-18 10:42:07 UTC 
Upstream patch is https://github.com/python/cpython/pull/18995 (backported to 2.7 by me on https://github.com/python/cpython/pull/19052).
Comment 13 Swamp Workflow Management 2020-03-23 20:45:03 UTC 
SUSE-SU-2020:0750-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1155094
CVE References: CVE-2019-18348
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    python36-3.6.10-4.9.1, python36-base-3.6.10-4.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2020-04-02 16:23:49 UTC 
SUSE-SU-2020:0854-1: An update that solves three vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1155094,1162224,1162367,1162825,1165894
CVE References: CVE-2019-18348,CVE-2019-9674,CVE-2020-8492
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE OpenStack Cloud 8 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE OpenStack Cloud 7 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server 12-SP5 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server 12-SP4 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Linux Enterprise Module for Web Scripting 12 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
SUSE Enterprise Storage 5 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1
HPE Helion Openstack 8 (src):    python3-3.4.10-25.45.1, python3-base-3.4.10-25.45.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Matej Cepl 2020-04-30 21:44:38 UTC 
SLE-10-SP3 has Python 2.4, it is too far away from the base to make port working, so WONTFIX there.
Comment 21 Swamp Workflow Management 2020-05-19 16:15:18 UTC 
SUSE-SU-2020:1339-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1155094,1162825
CVE References: CVE-2019-18348,CVE-2019-9674
Sources used:
SUSE Linux Enterprise Module for Python2 15-SP1 (src):    python-2.7.17-7.38.1, python-base-2.7.17-7.38.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    python-2.7.17-7.38.1, python-base-2.7.17-7.38.1, python-doc-2.7.17-7.38.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src):    python-2.7.17-7.38.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    python-2.7.17-7.38.1, python-base-2.7.17-7.38.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 23 Swamp Workflow Management 2020-05-22 22:16:49 UTC 
openSUSE-SU-2020:0696-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1155094,1162825
CVE References: CVE-2019-18348,CVE-2019-9674
Sources used:
openSUSE Leap 15.1 (src):    python-2.7.17-lp151.10.17.1, python-base-2.7.17-lp151.10.17.1, python-doc-2.7.17-lp151.10.17.1
Comment 24 Swamp Workflow Management 2020-06-03 13:22:25 UTC 
SUSE-SU-2020:1524-1: An update that solves three vulnerabilities and has 18 fixes is now available.

Category: security (moderate)
Bug References: 1027282,1041090,1042670,1073269,1073748,1078326,1078485,1081750,1084650,1086001,1149792,1153830,1155094,1159035,1162224,1162367,1162825,1165894,1170411,1171561,945401
CVE References: CVE-2019-18348,CVE-2019-9674,CVE-2020-8492
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE OpenStack Cloud 8 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE OpenStack Cloud 7 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Workstation Extension 12-SP5 (src):    python-base-2.7.17-28.42.1
SUSE Linux Enterprise Workstation Extension 12-SP4 (src):    python-base-2.7.17-28.42.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    python-rpm-macros-20200207.5feb6c1-3.19.1
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    python-base-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Server 12-SP5 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Server 12-SP4 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
SUSE Enterprise Storage 5 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1
HPE Helion Openstack 8 (src):    python-2.7.17-28.42.1, python-base-2.7.17-28.42.1, python-doc-2.7.17-28.42.1, python-rpm-macros-20200207.5feb6c1-3.19.1, shared-python-startup-0.1-1.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 25 Matej Cepl 2020-06-08 09:49:01 UTC 
Update has been released, this bug can be closed.
Comment 27 Alexandros Toptsoglou 2020-07-23 13:24:51 UTC 
Done
Comment 32 OBSbugzilla Bot 2020-11-26 21:50:06 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/851167 Factory / python36
Comment 33 OBSbugzilla Bot 2020-11-27 16:42:52 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/851367 Factory / python36
Comment 34 OBSbugzilla Bot 2020-12-01 18:22:46 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/852415 Factory / python36
Comment 35 OBSbugzilla Bot 2020-12-05 17:32:41 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/853277 Factory / python36
Comment 36 OBSbugzilla Bot 2020-12-05 19:12:48 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/853314 Factory / python36
Comment 41 Swamp Workflow Management 2020-12-17 14:18:58 UTC 
SUSE-SU-2020:3865-1: An update that solves four vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1155094,1162367,1174571,1176262,1178009,1179630
CVE References: CVE-2019-18348,CVE-2019-20916,CVE-2020-27619,CVE-2020-8492
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    python36-3.6.12-4.25.1, python36-core-3.6.12-4.25.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 42 OBSbugzilla Bot 2020-12-17 18:12:50 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/856737 Factory / python36
Comment 43 Swamp Workflow Management 2020-12-23 23:16:53 UTC 
SUSE-SU-2020:3930-1: An update that fixes 8 vulnerabilities, contains two features is now available.

Category: security (important)
Bug References: 1155094,1174091,1174571,1174701,1177211,1178009,1179193,1179630
CVE References: CVE-2019-16935,CVE-2019-18348,CVE-2019-20907,CVE-2019-5010,CVE-2020-14422,CVE-2020-26116,CVE-2020-27619,CVE-2020-8492
JIRA References: ECO-2799,SLE-13738
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    python3-3.6.12-3.67.2, python3-core-3.6.12-3.67.2
SUSE Linux Enterprise Server 15-LTSS (src):    python3-3.6.12-3.67.2, python3-core-3.6.12-3.67.2
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    python3-core-3.6.12-3.67.2
SUSE Linux Enterprise Module for Development Tools 15-SP2 (src):    python3-core-3.6.12-3.67.2
SUSE Linux Enterprise Module for Development Tools 15-SP1 (src):    python3-core-3.6.12-3.67.2
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    python3-3.6.12-3.67.2, python3-core-3.6.12-3.67.2
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    python3-3.6.12-3.67.2, python3-core-3.6.12-3.67.2
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    python3-3.6.12-3.67.2, python3-core-3.6.12-3.67.2
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    python3-3.6.12-3.67.2, python3-core-3.6.12-3.67.2
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    python3-3.6.12-3.67.2, python3-core-3.6.12-3.67.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 44 Swamp Workflow Management 2020-12-26 14:15:07 UTC 
openSUSE-SU-2020:2332-1: An update that fixes 8 vulnerabilities is now available.

Category: security (important)
Bug References: 1155094,1174091,1174571,1174701,1177211,1178009,1179193,1179630
CVE References: CVE-2019-16935,CVE-2019-18348,CVE-2019-20907,CVE-2019-5010,CVE-2020-14422,CVE-2020-26116,CVE-2020-27619,CVE-2020-8492
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    python3-3.6.12-lp152.4.12.2, python3-core-3.6.12-lp152.4.12.2, python3-documentation-3.6.12-lp152.4.12.2
Comment 45 Swamp Workflow Management 2020-12-26 20:14:59 UTC 
openSUSE-SU-2020:2333-1: An update that fixes 8 vulnerabilities is now available.

Category: security (important)
Bug References: 1155094,1174091,1174571,1174701,1177211,1178009,1179193,1179630
CVE References: CVE-2019-16935,CVE-2019-18348,CVE-2019-20907,CVE-2019-5010,CVE-2020-14422,CVE-2020-26116,CVE-2020-27619,CVE-2020-8492
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    python3-3.6.12-lp151.6.30.1, python3-core-3.6.12-lp151.6.30.1, python3-documentation-3.6.12-lp151.6.30.1
Comment 46 OBSbugzilla Bot 2021-09-17 22:40:08 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/919877 Factory / python
Comment 47 OBSbugzilla Bot 2021-10-06 14:42:59 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/923499 Factory / python36
Comment 48 OBSbugzilla Bot 2021-10-22 08:43:03 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/926876 Factory / python36
Comment 49 OBSbugzilla Bot 2022-02-06 22:30:54 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/951983 Factory / python
Comment 50 OBSbugzilla Bot 2022-02-09 19:11:04 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/953031 Factory / python
Comment 51 OBSbugzilla Bot 2022-06-10 08:40:59 UTC 
This is an autogenerated message for OBS integration:
This bug (1155094) was mentioned in
https://build.opensuse.org/request/show/981989 Factory / python
First Last Prev Next    This bug is not in your last search results.