https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T21:51:09.430120+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2019-18348 CVE-2019-18348 2026-10-04T21:51:09.446668+00:00

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

 https://vulnerability.circl.lu/vuln/usn-4333-1 USN-4333-1 — python2.7, python3.4, python3.5, python3.6, python3.7 vulnerabilities 2026-10-04T21:51:09.446748+00:00

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:16.04:LTS: python2.7, Ubuntu:16.04:LTS: python3.5, Ubuntu:18.04:LTS: python2.7, Ubuntu:18.04:LTS: python3.6

It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. (CVE-2019-18348)

It was discovered that Python incorrectly handled certain HTTP requests. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-8492)