Bug 1700824 (CVE-2019-11236)
| Summary: | CVE-2019-11236 python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ahardin, apevec, aurelien, bbuckingham, bcourt, bkearney, bleanhar, bmontgom, btotty, ccoleman, cstratak, dajohnso, dbecker, dedgar, eparis, extras-orphan, fschwarz, gblomqui, hhorak, hhudgeon, infra-sig, jburrell, jeremy, jgoulding, jjoyce, jokerman, jorton, jprause, jschluet, kbasil, kdixon, lbalhar, lhh, lpeer, lzap, mburns, mchappel, m.cyprian, mcyprian, metherid, mhayden, mhroncok, mhulan, mmccune, mrunge, ncoghlan, nstielau, orion, python-maint, python-sig, rchan, rhos-maint, rjerrido, rschiron, sclewis, sisharma, slavek.kabrda, slinaber, smilner, sponnaga, tflink, TicoTimo, torsava, vbellur |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | python-urllib3 1.24.3, python-urllib3 1.25 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 19:20:56 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1697188, 1697189, 1697190, 1697191, 1697192, 1697193, 1700825, 1703360, 1703361, 1703363, 1703458, 1706762, 1707088, 1724439, 1775363, 1775364, 1775365, 1778100, 1778101, 1778103, 1778107, 1778108, 1778109, 1778113, 1778114, 1778115, 1778116, 1778117, 1805086, 1805087, 1805088, 1805089, 1822420, 1822421 | ||
| Bug Blocks: | 1700840 | ||
|
Description
Marian Rehak
2019-04-17 12:48:04 UTC
Created python-urllib3 tracking bugs for this issue: Affects: fedora-all [bug 1700825] Additional references: https://github.com/urllib3/urllib3/issues/1553 https://github.com/urllib3/urllib3/commit/0aa3e24fcd75f1bb59ab159e9f8adb44055b2271 This issue is reproducible on Red Hat Gluster Storage 3, successfully injected the HTTP header. If an attacker manages to place a CRLF then he could exploit this vulnerability. All supported versions of Red Hat OpenStack Platform are affected by this flaw. Created python-urllib3 tracking bugs for this issue: Affects: openstack-rdo [bug 1707088] This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2272 https://access.redhat.com/errata/RHSA-2019:2272 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-11236 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3335 https://access.redhat.com/errata/RHSA-2019:3335 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3590 https://access.redhat.com/errata/RHSA-2019:3590 Upstream patch for 1.24 versions: https://github.com/urllib3/urllib3/commit/efddd7e7bad26188c3b692d1090cba768afa9162 There are actually 2 related patches for 1.24: https://github.com/urllib3/urllib3/commit/9b76785331243689a9d52cef3db05ef7462cb02d https://github.com/urllib3/urllib3/commit/efddd7e7bad26188c3b692d1090cba768afa9162 The second one is the one linked from comment 22 above, and it needs to be applied on top of the first one. Both patches mention CVE-2019-9740 in the commit message, which is the CVE for similar problem in urllib/urllib2 that is part of Python standard library. Created python-pip tracking bugs for this issue: Affects: epel-6 [bug 1775364] Affects: fedora-all [bug 1775363] Created python-pip-epel tracking bugs for this issue: Affects: epel-7 [bug 1775365] Created python-virtualenv tracking bugs for this issue: Affects: epel-6 [bug 1778101] Affects: fedora-30 [bug 1778100] Created python3-virtualenv tracking bugs for this issue: Affects: epel-7 [bug 1778103] This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:0850 https://access.redhat.com/errata/RHSA-2020:0850 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:0851 https://access.redhat.com/errata/RHSA-2020:0851 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1605 https://access.redhat.com/errata/RHSA-2020:1605 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1916 https://access.redhat.com/errata/RHSA-2020:1916 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:2068 https://access.redhat.com/errata/RHSA-2020:2068 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:2081 https://access.redhat.com/errata/RHSA-2020:2081 Statement: This issue affects the version of python-urllib3 shipped with Red Hat Gluster Storage 3, as it is vulnerable to CRLF injection. Red Hat Satellite 6.2 is on Maintenance Support 2 phase, hence only selected critical and important issues will be fixed. Please refer to Red Hat Satellite Product Life Cycle page for more information. In Red Hat OpenStack Platform 13, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-urllib3 package. |