Injection in python
Priority MEDIUM 50CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 8 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.08543 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 5 advisoriesRed Hat: 8 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | python | python 3.10.0b1, python 3.9.5, python 3.8.11, python 3.7.11, python 3.6.14 | — | No fix listed | CNA |
- python Vendor— Affected python 3.10.0b1, python 3.9.5, python 3.8.11, python 3.7.11, python 3.6.14 Fixed in — No fix listed CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | before 3.6.14; 3.7.0 to before 3.7.11; 3.8.0 to before 3.8.11; 3.9.0 to before 3.9.5 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha1:*:*:*:*:*:* | 3.10.0 alpha1 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha2:*:*:*:*:*:* | 3.10.0 alpha2 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha3:*:*:*:*:*:* | 3.10.0 alpha3 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha4:*:*:*:*:*:* | 3.10.0 alpha4 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha5:*:*:*:*:*:* | 3.10.0 alpha5 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha6:*:*:*:*:*:* | 3.10.0 alpha6 | Vulnerable | python-pillow |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions before 3.6.14; 3.7.0 to before 3.7.11; 3.8.0 to before 3.8.11; 3.9.0 to before 3.9.5 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha1:*:*:*:*:*:* Versions 3.10.0 alpha1 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha2:*:*:*:*:*:* Versions 3.10.0 alpha2 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha3:*:*:*:*:*:* Versions 3.10.0 alpha3 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha4:*:*:*:*:*:* Versions 3.10.0 alpha4 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha5:*:*:*:*:*:* Versions 3.10.0 alpha5 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha6:*:*:*:*:*:* Versions 3.10.0 alpha6 Vulnerable ·python-pillow
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Oracle |
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
Remediation
Red Hat 5 advisories
- RHSA-2022:6457 Released 2022-09-13 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-47.el8_6, platform-python-debug-3.6.8-47.el8_6, platform-python-devel-3.6.8-47.el8_6 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-47.el8_6, python3-3.6.8-47.el8_6, python3-libs-3.6.8-47.el8_6 +1
- RHSA-2022:1821 Released 2022-05-10 · Red Hat rating Moderatepython27:2.7 security update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-10.module+el8.5.0+11014+88fc0d0b.noarch::python27:2.7 +47
- RHSA-2022:1764 Released 2022-05-10 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
- Red Hat Enterprise Linux CRB (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
Show 2 more Red Hat advisories
- RHSA-2022:1663 Released 2022-05-02 · Red Hat rating Moderatepython27-python and python27-python-pip security update
- Red Hat Software Collections for RHEL Workstation(v. 7) python27-python-2.7.18-4.el7, python27-python-debug-2.7.18-4.el7, python27-python-devel-2.7.18-4.el7 +4
- Red Hat Software Collections for RHEL(v. 7) python27-python-2.7.18-4.el7, python27-python-debug-2.7.18-4.el7, python27-python-devel-2.7.18-4.el7 +4
- RHSA-2021:3254 Released 2021-08-24 · Red Hat rating Moderaterh-python38 security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:1764, RHSA-2022:1821, RHSA-2022:6457 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2022:6457 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2022:1764 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:1663 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:1663 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3254 |
Not affected: 4 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Software Collections for RHEL Workstation(v. 7)
- Red Hat Software Collections for RHEL(v. 7)
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0391
- 2026-10-03 Alias added: GHSA-75jm-2xrg-5wpf
- 2026-10-16 EPSS moved to the 95th–99th percentile
References
Exploit 1
Advisory 4
Sources
- CVE-2022-0391 · CVE Program
- CVE-2022-0391 · NVD
- FIRST EPSS
- GHSA-75jm-2xrg-5wpf · GitHub Advisory Database · CC BY 4.0
- CVE-2022-0391 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences