Bug 1700824 (CVE-2019-11236)

Summary: CVE-2019-11236 python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahardin, apevec, aurelien, bbuckingham, bcourt, bkearney, bleanhar, bmontgom, btotty, ccoleman, cstratak, dajohnso, dbecker, dedgar, eparis, extras-orphan, fschwarz, gblomqui, hhorak, hhudgeon, infra-sig, jburrell, jeremy, jgoulding, jjoyce, jokerman, jorton, jprause, jschluet, kbasil, kdixon, lbalhar, lhh, lpeer, lzap, mburns, mchappel, m.cyprian, mcyprian, metherid, mhayden, mhroncok, mhulan, mmccune, mrunge, ncoghlan, nstielau, orion, python-maint, python-sig, rchan, rhos-maint, rjerrido, rschiron, sclewis, sisharma, slavek.kabrda, slinaber, smilner, sponnaga, tflink, TicoTimo, torsava, vbellur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: python-urllib3 1.24.3, python-urllib3 1.25 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-08-06 19:20:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1697188, 1697189, 1697190, 1697191, 1697192, 1697193, 1700825, 1703360, 1703361, 1703363, 1703458, 1706762, 1707088, 1724439, 1775363, 1775364, 1775365, 1778100, 1778101, 1778103, 1778107, 1778108, 1778109, 1778113, 1778114, 1778115, 1778116, 1778117, 1805086, 1805087, 1805088, 1805089, 1822420, 1822421    
Bug Blocks: 1700840    

Description Marian Rehak 2019-04-17 12:48:04 UTC
The current implementation of python-urllib3 does not encode the ā€˜\r\n’ sequence in the query string, which allowed the attacker to manipulate a HTTP header with the ā€˜\r\n’ sequence in it, so the attacker could insert arbitrary content to the new line of the HTTP header.

External References:
https://bugs.python.org/issue36276

Comment 1 Marian Rehak 2019-04-17 12:48:17 UTC
Created python-urllib3 tracking bugs for this issue:

Affects: fedora-all [bug 1700825]

Comment 8 Hardik Vyas 2019-04-26 14:02:44 UTC
This issue is reproducible on Red Hat Gluster Storage 3, successfully injected the HTTP header. If an attacker manages to place a CRLF then he could exploit this vulnerability.

Comment 13 Nick Tait 2019-05-06 19:12:41 UTC
All supported versions of Red Hat OpenStack Platform are affected by this flaw.

Comment 14 Nick Tait 2019-05-06 19:12:54 UTC
Created python-urllib3 tracking bugs for this issue:

Affects: openstack-rdo [bug 1707088]

Comment 18 errata-xmlrpc 2019-08-06 12:34:20 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2272 https://access.redhat.com/errata/RHSA-2019:2272

Comment 19 Product Security DevOps Team 2019-08-06 19:20:56 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11236

Comment 20 errata-xmlrpc 2019-11-05 20:38:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3335 https://access.redhat.com/errata/RHSA-2019:3335

Comment 21 errata-xmlrpc 2019-11-05 21:16:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3590 https://access.redhat.com/errata/RHSA-2019:3590

Comment 22 Riccardo Schirone 2019-11-21 15:42:57 UTC
Upstream patch for 1.24 versions:
https://github.com/urllib3/urllib3/commit/efddd7e7bad26188c3b692d1090cba768afa9162

Comment 23 Tomas Hoger 2019-11-21 19:31:42 UTC
There are actually 2 related patches for 1.24:

https://github.com/urllib3/urllib3/commit/9b76785331243689a9d52cef3db05ef7462cb02d
https://github.com/urllib3/urllib3/commit/efddd7e7bad26188c3b692d1090cba768afa9162

The second one is the one linked from comment 22 above, and it needs to be applied on top of the first one.  Both patches mention CVE-2019-9740 in the commit message, which is the CVE for similar problem in urllib/urllib2 that is part of Python standard library.

Comment 24 Tomas Hoger 2019-11-21 19:38:11 UTC
Created python-pip tracking bugs for this issue:

Affects: epel-6 [bug 1775364]
Affects: fedora-all [bug 1775363]


Created python-pip-epel tracking bugs for this issue:

Affects: epel-7 [bug 1775365]

Comment 25 Tomas Hoger 2019-11-29 10:24:18 UTC
Created python-virtualenv tracking bugs for this issue:

Affects: epel-6 [bug 1778101]
Affects: fedora-30 [bug 1778100]


Created python3-virtualenv tracking bugs for this issue:

Affects: epel-7 [bug 1778103]

Comment 28 errata-xmlrpc 2020-03-17 16:18:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0850 https://access.redhat.com/errata/RHSA-2020:0850

Comment 29 errata-xmlrpc 2020-03-17 16:18:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0851 https://access.redhat.com/errata/RHSA-2020:0851

Comment 31 errata-xmlrpc 2020-04-28 15:29:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1605 https://access.redhat.com/errata/RHSA-2020:1605

Comment 32 errata-xmlrpc 2020-04-28 16:08:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1916 https://access.redhat.com/errata/RHSA-2020:1916

Comment 33 errata-xmlrpc 2020-05-12 18:37:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2068 https://access.redhat.com/errata/RHSA-2020:2068

Comment 34 errata-xmlrpc 2020-05-12 18:38:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2081 https://access.redhat.com/errata/RHSA-2020:2081

Comment 37 Nick Tait 2020-12-19 20:40:15 UTC
Statement:

This issue affects the version of python-urllib3 shipped with Red Hat Gluster Storage 3, as it is vulnerable to CRLF injection.

Red Hat Satellite 6.2 is on Maintenance Support 2 phase, hence only selected critical and important issues will be fixed. Please refer to Red Hat Satellite Product Life Cycle page for more information.

In Red Hat OpenStack Platform 13, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-urllib3 package.