CRLF injection vulnerability

[hannob]

At https://bugs.python.org/issue36276 there's an issue in Python's urllib that an attacker controlling the request parameter can inject headers by injecting CR/LF chars.

A commenter mentions that the same bug is present in urllib3:
https://bugs.python.org/issue36276#msg337837

So reporting it here to make sure it gets attention.

[haikuginger]

I confirmed that I was not able to reproduce and that the escaped CRLF was present in the querystring as of the current master. Will investigate to see what the bisection point was.

[haikuginger]

Verified as fixed in #1487, but that change has not been released. I recommend we release 1.24.2 with that change as soon as possible, @sethmlarson @theacodes.

[theacodes]

I will try to cut a release soon, unless Seth wants to beat me to it. Thank you, Jess.

…

On Mon, Mar 18, 2019, 10:48 AM Jess Shapiro ***@***.***> wrote: Verified as fixed in #1487 <#1487>, but that change has not been released. I recommend we release 1.24.2 with that change as soon as possible, @sethmlarson <https://github.com/sethmlarson> @theacodes <https://github.com/theacodes> . — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1553 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAPUc8zaDyI-Qpxr9rfoeOeDZvcjSrmrks5vX9GFgaJpZM4b6V-J> .

[sethmlarson]

Without #1531 or IRI support in rfc3986 releasing master in it's current state will break backwards compatibility with international URLs.

[haikuginger]

I've done some checking and requests appears to have handling so indirect consumers via requests should not be vulnerable through us, if that's a useful datum to have.

[vstinner]

CVE-2016-5699, CVE-2019-9740 and CVE-2019-9947 have been assigned to HTTP Header Injection vulnerabilities in Python: see https://bugs.python.org/issue30458 for more information.

[Plazmaz]

I was able to reproduce this with requests.get using urllib, haven't tested with urllib3 though.

[carnil]

CVE-2019-11236 was assigned for this issue.

[rschultheis]

👋 Hi! I've noticed that CVE-2019-11236 has been assigned to the CRLF injection issue described here. It seems that the library has been patched in GitHub, but no new release has been made to pypi. Will a new release containing the fix be made to pypi soon? Based on @theacodes comment it seems like a release was going to be made, but I also see her status has her perhaps unavailable. Is someone else perhaps able to cut a new release into pypi?

[sethmlarson]

@rschultheis Per my comment we cannot cut a release until IRI support is fixed in rfc3986.

[rschultheis]

Thank you @sethmlarson , I will watch that PR 🙇

[vstinner]

"It seems that the library has been patched in GitHub"

Do you have a reference to the change?

[sethmlarson]

@vstinner 0aa3e24

[lgbaldoni]

Is the problem fixed in 1.24.2? I couldn't find any reference to it in the changelog.

[sethmlarson]

No it is not, this change will be fixed in 1.25 and is next on my list of work.