CVE-2022-0391: Input Validation
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks.
Other sources
Python could provide weaker than expected security, cause by a improper input validation by the urllib.parse module. By sending a specially-crafted request using \r and \n characters in the URL path. An attacker could exploit this vulnerability to perform injection attack or launch further attacks on the system.
— IBM
Python urllib.parse does not sanitize URLs containing ASCII newline and tabs.
Reference: https://bugs.python.org/issue43882
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-0391?
CVE-2022-0391 is a vulnerability in Python that allows characters like '\r' and '\n' in the URL path, resulting in weaker than expected security.
What is the severity of CVE-2022-0391?
CVE-2022-0391 has a severity score of 7.5 (High).
How does CVE-2022-0391 affect Python?
CVE-2022-0391 affects Python versions up to 3.10.0 and allows improper input validation in the urllib.parse module.
How can I fix CVE-2022-0391?
To fix CVE-2022-0391, upgrade to Python version 3.10.0 or apply the appropriate remedy provided by Red Hat.
Where can I find more information about CVE-2022-0391?
You can find more information about CVE-2022-0391 in the references provided: [link1], [link2].