Yüksek CVSS 7.5 PoC var

CVE-2022-0391: Python: güvenlik açığı

Yayın: 10 Şubat 2022 02:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: %8,54 (yüzdelik 95)
CWE: CWE-74
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	—	—	3.6.14
python-python	3.7.0	—	3.7.11
python-python	3.8.0	—	3.8.11
python-python	3.9.0	—	3.9.5
python-python	3.10.0	3.10.0	—
python-python	3.10.0	3.10.0	—
python-python	3.10.0	3.10.0	—
python-python	3.10.0	3.10.0	—
python-python	3.10.0	3.10.0	—
python-python	3.10.0	3.10.0	—
netapp-active-iq-unified-manager	—	—	—
netapp-hci	—	—	—
netapp-management-services-for-element-software	—	—	—
netapp-ontap-select-deploy-administration-utility	—	—	—
netapp-solidfire-enterprise-sds-hci-storage-node	—	—	—
netapp-hci-compute-node	—	—	—
fedoraproject-fedora	34	34	—
fedoraproject-fedora	35	35	—
oracle-http-server	12.2.1.3.0	12.2.1.3.0	—
oracle-http-server	12.2.1.4.0	12.2.1.4.0	—
oracle-zfs-storage-appliance-kit	8.8	8.8	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları