Summaryinfo

A vulnerability, which was classified as critical, was found in Python up to 3.6.13/3.7.10/3.8.10/3.9.4. This affects the function urlparse in the library urllib.parse of the component URL Handler. Such manipulation leads to injection. This vulnerability is documented as CVE-2022-0391. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Python up to 3.6.13/3.7.10/3.8.10/3.9.4 (Programming Language Software). Affected by this issue is the function urlparse in the library urllib.parse of the component URL Handler. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability.

The weakness was released 02/10/2022. The advisory is shared for download at bugs.python.org. This vulnerability is handled as CVE-2022-0391 since 01/27/2022. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1055.

The vulnerability scanner Nessus provides a plugin with the ID 211144 (Fedora 37 : python2.7 (2022-b8559307db)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.6.14, 3.7.11, 3.8.11, 3.9.5 or 3.10.0b1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (211144) and EUVD (EUVD-2022-15539). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Name

• Python

Version

• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4
• 3.6.5
• 3.6.6
• 3.6.7
• 3.6.8
• 3.6.9
• 3.6.10
• 3.6.11
• 3.6.12
• 3.6.13
• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7
• 3.7.8
• 3.7.9
• 3.7.10
• 3.8.0
• 3.8.1
• 3.8.2
• 3.8.3
• 3.8.4
• 3.8.5
• 3.8.6
• 3.8.7
• 3.8.8
• 3.8.9
• 3.8.10
• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion