CVE catalog

CVE-2019-9740

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the firs

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
5.41% · Oct 25, 2026

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpepythonNot reported3.7.4fixed
CpepythonNot reported3.5.8fixed
CpepythonNot reported3.6.9fixed
CpepythonNot reported3.7.4fixed
Ubuntupython2.7pro2.7.5-8ubuntu3vulnerable
Ubuntupython2.7pro2.7.5-8ubuntu4vulnerable
Ubuntupython2.7pro2.7.6-2vulnerable
Ubuntupython2.7pro2.7.6-2ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-3vulnerable
Ubuntupython2.7pro2.7.6-3ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-4vulnerable
Ubuntupython2.7pro2.7.6-4ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-5vulnerable
Ubuntupython2.7pro2.7.6-7vulnerable
Ubuntupython2.7pro2.7.6-8vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.2vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.3vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.4vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.5vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm2fixed
Ubuntupython3.4pro3.4~b1-0ubuntu3vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu4vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu6vulnerable
Ubuntupython3.4pro3.4~b1-5ubuntu2vulnerable
Ubuntupython3.4pro3.4~b2-1vulnerable
Ubuntupython3.4pro3.4~b3-1ubuntu1vulnerable
Ubuntupython3.4pro3.4~rc1-1build1vulnerable
Ubuntupython3.4pro3.4~rc2-1vulnerable
Ubuntupython3.4pro3.4~rc3-0ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.3vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.4vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.5vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.6vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm2fixed
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.4~14.04.1vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.4~14.04.1+esm1fixed
Ubuntupython2.716.042.7.10-4ubuntu1vulnerable
Ubuntupython2.716.042.7.10-4ubuntu2vulnerable
Ubuntupython2.716.042.7.11-2vulnerable
Ubuntupython2.716.042.7.11-3vulnerable
Ubuntupython2.716.042.7.11-4vulnerable
Ubuntupython2.716.042.7.11-6vulnerable
Ubuntupython2.716.042.7.11-7vulnerable
Ubuntupython2.716.042.7.11-7ubuntu1vulnerable
Ubuntupython2.716.042.7.12-1~16.04vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.1vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.2vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.3vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.4vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.8fixed
Ubuntupython3.516.043.5.0-3vulnerable
Ubuntupython3.516.043.5.0-3ubuntu1vulnerable
Ubuntupython3.516.043.5.1~rc1-2ubuntu1vulnerable
Ubuntupython3.516.043.5.1-1vulnerable
Ubuntupython3.516.043.5.1-2vulnerable
Ubuntupython3.516.043.5.1-3vulnerable
Ubuntupython3.516.043.5.1-5vulnerable
Ubuntupython3.516.043.5.1-6ubuntu1vulnerable
Ubuntupython3.516.043.5.1-6ubuntu2vulnerable
Ubuntupython3.516.043.5.1-9ubuntu1vulnerable
Ubuntupython3.516.043.5.1-10vulnerable
Ubuntupython3.516.043.5.2-2~16.01vulnerable
Ubuntupython3.516.043.5.2-2~16.04vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.1vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.2vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.3vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.4vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.5vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.8fixed
Ubuntupython2.718.042.7.14-2ubuntu2vulnerable
Ubuntupython2.718.042.7.14-4vulnerable
Ubuntupython2.718.042.7.14-6vulnerable
Ubuntupython2.718.042.7.14-7vulnerable
Ubuntupython2.718.042.7.14-8vulnerable
Ubuntupython2.718.042.7.15~rc1-1vulnerable
Ubuntupython2.718.042.7.15~rc1-1ubuntu0.1vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04.1fixed
Ubuntupython3.618.043.6.3-1ubuntu1vulnerable
Ubuntupython3.618.043.6.4~rc1-1vulnerable
Ubuntupython3.618.043.6.4~rc1-2vulnerable
Ubuntupython3.618.043.6.4-1vulnerable
Ubuntupython3.618.043.6.4-2vulnerable
Ubuntupython3.618.043.6.4-3build1vulnerable
Ubuntupython3.618.043.6.4-4vulnerable
Ubuntupython3.618.043.6.5~rc1-1vulnerable
Ubuntupython3.618.043.6.5-3vulnerable
Ubuntupython3.618.043.6.6-1~18.04vulnerable
Ubuntupython3.618.043.6.7-1~18.04vulnerable
Ubuntupython3.618.043.6.8-1~18.04.1vulnerable
Ubuntupython3.618.043.6.8-1~18.04.2fixed
Debianpython2.7112.7.16-3fixed
Opensusepython-CherryPytumbleweed18.10.0-4.1fixed
Opensusepython-CherryPytumbleweed18.6.1-1.2fixed
Opensusepython-CherryPytumbleweed18.9.0-3.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpepythoncpeNot reported3.7.4Not reportedNVD-CVE-2019-9740Not reported
CpepythoncpeNot reported3.5.8Not reportedNVD-CVE-2019-9740Not reported
CpepythoncpeNot reported3.6.9Not reportedNVD-CVE-2019-9740Not reported
CpepythoncpeNot reported3.7.4Not reportedNVD-CVE-2019-9740Not reported
Ubuntupython2.7debpro2.7.6-8ubuntu0.6+esm2Not reportedUBUNTU-CVE-2019-9740Not reported
Ubuntupython3.4debpro3.4.3-1ubuntu1~14.04.7+esm2Not reportedUBUNTU-CVE-2019-9740Not reported
Ubuntupython3.5debpro3.5.2-2ubuntu0~16.04.4~14.04.1+esm1Not reportedUBUNTU-CVE-2019-9740Not reported
Ubuntupython2.7deb16.042.7.12-1ubuntu0~16.04.8Not reportedUBUNTU-CVE-2019-9740Not reported
Ubuntupython3.5deb16.043.5.2-2ubuntu0~16.04.8Not reportedUBUNTU-CVE-2019-9740Not reported
Ubuntupython2.7deb18.042.7.15-4ubuntu4~18.04.1Not reportedUBUNTU-CVE-2019-9740Not reported
Ubuntupython3.6deb18.043.6.8-1~18.04.2Not reportedUBUNTU-CVE-2019-9740Not reported
Debianpython2.7deb112.7.16-3Not reportedDEBIAN-CVE-2019-9740Not reported
Opensusepython-CherryPyrpmtumbleweed18.10.0-4.1Not reportedOPENSUSE-SU-2026:11378-1Not reported
Opensusepython-CherryPyrpmtumbleweed18.6.1-1.2Not reportedOPENSUSE-SU-2024:11204-1Not reported
Opensusepython-CherryPyrpmtumbleweed18.9.0-3.3Not reportedOPENSUSE-SU-2024:14128-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [python313-CherryPy]Unknown

    Source package: [python-CherryPy]

    Details (1)

    • 18.10.0-4.1 · noarch · tumbleweed

      Unknown · Fixed: 18.10.0-4.1, 18.6.1-1.2, 18.9.0-3.3

      Version impact unknown

      nvd · python-CherryPy · opensuse · tumbleweed

  • [python314-CherryPy]Unknown

    Source package: [python-CherryPy]

    Details (1)

    • 18.10.0-4.1 · noarch · tumbleweed

      Unknown · Fixed: 18.10.0-4.1, 18.6.1-1.2, 18.9.0-3.3

      Version impact unknown

      nvd · python-CherryPy · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]