Skip to content

[CVE-2019-9947] Header Injection in urllib #80087

@push0ebp

Description

@push0ebp
mannequin
BPO 35906
Nosy @gpshead, @orsenthil, @vstinner, @tiran, @vadmium, @matrixise, @push0ebp, @ware
PRs
  • bpo-35906: Avoid headers injections in urllib #11768
  • bpo-35906: Fix CRLF injection in urllib #12524
  • Superseder
  • bpo-30458: [security][CVE-2019-9740][CVE-2019-9947] HTTP Header Injection (follow-up of CVE-2016-5699)
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = <Date 2019-04-10.09:32:49.871>
    created_at = <Date 2019-02-06.00:32:11.669>
    labels = ['type-security', '3.8', '3.7', 'library']
    title = '[CVE-2019-9947] Header Injection in urllib'
    updated_at = <Date 2019-04-10.09:32:49.870>
    user = 'https://github.com/push0ebp'

    bugs.python.org fields:

    activity = <Date 2019-04-10.09:32:49.870>
    actor = 'gregory.p.smith'
    assignee = 'none'
    closed = True
    closed_date = <Date 2019-04-10.09:32:49.871>
    closer = 'gregory.p.smith'
    components = ['Library (Lib)']
    creation = <Date 2019-02-06.00:32:11.669>
    creator = 'push0ebp'
    dependencies = []
    files = []
    hgrepos = []
    issue_num = 35906
    keywords = ['patch', 'patch', 'patch']
    message_count = 7.0
    messages = ['334896', '334906', '334999', '335000', '335005', '339835', '339842']
    nosy_count = 8.0
    nosy_names = ['gregory.p.smith', 'orsenthil', 'vstinner', 'christian.heimes', 'martin.panter', 'matrixise', 'push0ebp', 'ware']
    pr_nums = ['11768', '12524']
    priority = 'normal'
    resolution = 'duplicate'
    stage = 'resolved'
    status = 'closed'
    superseder = '30458'
    type = 'security'
    url = 'https://bugs.python.org/issue35906'
    versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8']

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.7 (EOL)end of life3.8 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

      Projects

      No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions