A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2022-02-09T00:00:00

Updated: 2024-08-02T23:25:40.603Z

Reserved: 2022-01-27T00:00:00

Link: CVE-2022-0391

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-02-09T23:15:16.580

Modified: 2024-11-21T06:38:31.507

Link: CVE-2022-0391

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-04-18T00:00:00Z

Links: CVE-2022-0391 - Bugzilla