CVE-2019-11236: CRLF Injection

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.

— GitHub

Python urllib3 is vulnerable to CRLF injection, caused by improper validation of user-supplied input by the request parameter. By sending a specially-crafted HTTP response containing CRLF character sequences, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

— IBM

The current implementation of python-urllib3 does not encode the ‘\r\n’ sequence in the query string, which allowed the attacker to manipulate a HTTP header with the ‘\r\n’ sequence in it, so the attacker could insert arbitrary content to the new line of the HTTP header.

External References: https://bugs.python.org/issue36276

— Red Hat