CVE-2022-0391

Description

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

How to fix CVE-2022-0391

To remediate CVE-2022-0391, upgrade the affected package to a fixed version below.

—upgrade to 3.6.14 or later
—upgrade to 3.6.14 or later
—upgrade to 3.6.14 or later
—upgrade to 7.3.5+dfsg-2+deb11u4 or later
—upgrade to 2.7.18-8+deb11u1 or later
—upgrade to 3.9.2-1+deb11u3 or later
—upgrade to 3.9.2-1+deb11u3 or later

Is CVE-2022-0391 being exploited?

Moderate — EPSS is 8.3%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (7)

from 0, < 3.6.14, >= 3.7.0, < 3.7.11, >= 3.8.0, < 3.8.11, >= 3.9.0, < 3.9.5
from 0, < 3.6.14, >= 3.7.0, < 3.7.11, >= 3.8.0, < 3.8.11, >= 3.9.0, < 3.9.5
from 0, < 3.6.14, >= 3.7.0, < 3.7.11, >= 3.8.0, < 3.8.11, >= 3.9.0, < 3.9.5
from 0, < 7.3.5+dfsg-2+deb11u4
from 0, < 2.7.18-8+deb11u1
from 0, < 3.9.2-1+deb11u3
from 0, < 3.9.2-1+deb11u3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N