CVE catalog

CVE-2022-0391

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C
Published
Updated
Source
[NVD] · [CVE record]
EPSS
8.54% · Oct 25, 2026

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpypy3sid8.0.1+dfsg-1fixed
Debianpypy3forky8.0.1+dfsg-1fixed
Debianpypy3trixie7.3.19+dfsg-2fixed
Debianpypy3bookworm7.3.11+dfsg-2+deb12u3fixed
CpepythonNot reported3.6.14fixed
CpepythonNot reported3.7.11fixed
CpepythonNot reported3.8.11fixed
CpepythonNot reported3.9.5fixed
CpepythonNot reportedNot reportedunknown
CpepythonNot reportedNot reportedunknown
CpepythonNot reportedNot reportedunknown
CpepythonNot reportedNot reportedunknown
CpepythonNot reportedNot reportedunknown
CpepythonNot reportedNot reportedunknown
Cpeactive_iq_unified_managerNot reportedNot reportedunknown
CpehciNot reportedNot reportedunknown
Cpemanagement_services_for_element_softwareNot reportedNot reportedunknown
Cpeontap_select_deploy_administration_utilityNot reportedNot reportedunknown
Cpesolidfire\,_enterprise_sds_\&_hci_storage_nodeNot reportedNot reportedunknown
Cpehci_compute_nodeNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
Cpehttp_serverNot reportedNot reportedunknown
Cpehttp_serverNot reportedNot reportedunknown
Ubuntupython2.7pro2.7.18-8build1vulnerable
Ubuntupython2.7pro2.7.18-13vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.1vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.1+esm2fixed
Ubuntupython3.4pro3.4~b1-0ubuntu3vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu4vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu6vulnerable
Ubuntupython3.4pro3.4~b1-5ubuntu2vulnerable
Ubuntupython3.4pro3.4~b2-1vulnerable
Ubuntupython3.4pro3.4~b3-1ubuntu1vulnerable
Ubuntupython3.4pro3.4~rc1-1build1vulnerable
Ubuntupython3.4pro3.4~rc2-1vulnerable
Ubuntupython3.4pro3.4~rc3-0ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.3vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.4vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.5vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.6vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm2vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm4vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm6vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm7vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm8vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm10vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm11vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm12fixed
Ubuntupython3.5pro3.5.0-3vulnerable
Ubuntupython3.5pro3.5.0-3ubuntu1vulnerable
Ubuntupython3.5pro3.5.1~rc1-2ubuntu1vulnerable
Ubuntupython3.5pro3.5.1-1vulnerable
Ubuntupython3.5pro3.5.1-2vulnerable
Ubuntupython3.5pro3.5.1-3vulnerable
Ubuntupython3.5pro3.5.1-5vulnerable
Ubuntupython3.5pro3.5.1-6ubuntu1vulnerable
Ubuntupython3.5pro3.5.1-6ubuntu2vulnerable
Ubuntupython3.5pro3.5.1-9ubuntu1vulnerable
Ubuntupython3.5pro3.5.1-10vulnerable
Ubuntupython3.5pro3.5.2-2~16.01vulnerable
Ubuntupython3.5pro3.5.2-2~16.04vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.1vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.2vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.3vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.4vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.5vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.8vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.9vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.10vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.11vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.12vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm1vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm2fixed
Ubuntupython2.718.042.7.14-2ubuntu2vulnerable
Ubuntupython2.718.042.7.14-4vulnerable
Ubuntupython2.718.042.7.14-6vulnerable
Ubuntupython2.718.042.7.14-7vulnerable
Ubuntupython2.718.042.7.14-8vulnerable
Ubuntupython2.718.042.7.15~rc1-1vulnerable
Ubuntupython2.718.042.7.15~rc1-1ubuntu0.1vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04.1vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04.2vulnerable
Ubuntupython2.718.042.7.17-1~18.04vulnerable
Ubuntupython2.718.042.7.17-1~18.04ubuntu1vulnerable
Ubuntupython2.718.042.7.17-1~18.04ubuntu1.1vulnerable
Ubuntupython2.718.042.7.17-1~18.04ubuntu1.2vulnerable
Ubuntupython2.718.042.7.17-1~18.04ubuntu1.3vulnerable
Ubuntupython2.718.042.7.17-1~18.04ubuntu1.5vulnerable
Ubuntupython2.718.042.7.17-1~18.04ubuntu1.6vulnerable
Ubuntupython2.718.042.7.17-1~18.04ubuntu1.7fixed
Ubuntupython3.618.043.6.3-1ubuntu1vulnerable
Ubuntupython3.618.043.6.4~rc1-1vulnerable
Ubuntupython3.618.043.6.4~rc1-2vulnerable
Ubuntupython3.618.043.6.4-1vulnerable
Ubuntupython3.618.043.6.4-2vulnerable
Ubuntupython3.618.043.6.4-3build1vulnerable
Ubuntupython3.618.043.6.4-4vulnerable
Ubuntupython3.618.043.6.5~rc1-1vulnerable
Ubuntupython3.618.043.6.5-3vulnerable
Ubuntupython3.618.043.6.6-1~18.04vulnerable
Ubuntupython3.618.043.6.7-1~18.04vulnerable
Ubuntupython3.618.043.6.8-1~18.04.1vulnerable
Ubuntupython3.618.043.6.8-1~18.04.2vulnerable
Ubuntupython3.618.043.6.8-1~18.04.3vulnerable
Ubuntupython3.618.043.6.9-1~18.04vulnerable
Ubuntupython3.618.043.6.9-1~18.04ubuntu1vulnerable
Ubuntupython3.618.043.6.9-1~18.04ubuntu1.1vulnerable
Ubuntupython3.618.043.6.9-1~18.04ubuntu1.3vulnerable
Ubuntupython3.618.043.6.9-1~18.04ubuntu1.4vulnerable
Ubuntupython3.618.043.6.9-1~18.04ubuntu1.6vulnerable
Ubuntupython3.618.043.6.9-1~18.04ubuntu1.7fixed
Ubuntupython3.7pro3.7.0~a2-1vulnerable
Ubuntupython3.7pro3.7.0~a3-1vulnerable
Ubuntupython3.7pro3.7.0~a3-2vulnerable
Ubuntupython3.7pro3.7.0~a3-3vulnerable
Ubuntupython3.7pro3.7.0~a4-1vulnerable
Ubuntupython3.7pro3.7.0~b1-1vulnerable
Ubuntupython3.7pro3.7.0~b1-1build1vulnerable
Ubuntupython3.7pro3.7.0~b2-1vulnerable
Ubuntupython3.7pro3.7.0~b3-1vulnerable
Ubuntupython3.7pro3.7.0-1~18.04vulnerable
Ubuntupython3.7pro3.7.1-1~18.04vulnerable
Ubuntupython3.7pro3.7.3-2~18.04.1vulnerable
Ubuntupython3.7pro3.7.5-2~18.04vulnerable
Ubuntupython3.7pro3.7.5-2~18.04.4vulnerable
Ubuntupython3.7pro3.7.5-2ubuntu1~18.04.2vulnerable
Ubuntupython3.7pro3.7.5-2ubuntu1~18.04.2+esm1vulnerable
Ubuntupython3.7pro3.7.5-2ubuntu1~18.04.2+esm2vulnerable
Ubuntupython3.7pro3.7.5-2ubuntu1~18.04.2+esm3fixed
Ubuntupython3.8pro3.8.0-3~18.04vulnerable
Ubuntupython3.8pro3.8.0-3~18.04.1vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm1vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm2fixed
Ubuntupython3.820.043.8.0-1vulnerable
Ubuntupython3.820.043.8.0-2vulnerable
Ubuntupython3.820.043.8.0-3vulnerable
Ubuntupython3.820.043.8.0-4vulnerable
Ubuntupython3.820.043.8.0-5vulnerable
Ubuntupython3.820.043.8.1-2ubuntu3vulnerable
Ubuntupython3.820.043.8.2~rc1-1ubuntu1vulnerable
Ubuntupython3.820.043.8.2-1vulnerable
Ubuntupython3.820.043.8.2-1ubuntu1vulnerable
Ubuntupython3.820.043.8.2-1ubuntu1.1vulnerable
Ubuntupython3.820.043.8.2-1ubuntu1.2vulnerable
Ubuntupython3.820.043.8.5-1~20.04vulnerable
Ubuntupython3.820.043.8.5-1~20.04.2vulnerable
Ubuntupython3.820.043.8.5-1~20.04.3vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.1vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.2vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.4fixed
Ubuntupython3.9pro3.9.0~rc1-1~20.04vulnerable
Ubuntupython3.9pro3.9.0-5~20.04vulnerable
Ubuntupython3.9pro3.9.5-3~20.04.1vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm1vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm2vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm3vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm4vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm5vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm6vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm7vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm8vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm9vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm10vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm11vulnerable
Opensusepythontumbleweed2.7.18-16.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpypy3sourcesid7.3.6+dfsg-1not yet assignedNot reportedNot reported
Debianpypy3sourceforky7.3.6+dfsg-1not yet assignedNot reportedNot reported
Debianpypy3sourcetrixie7.3.6+dfsg-1not yet assignedNot reportedNot reported
Debianpypy3sourcebookworm7.3.6+dfsg-1not yet assignedNot reportedNot reported
CpepythoncpeNot reported3.6.14Not reportedNVD-CVE-2022-0391Not reported
CpepythoncpeNot reported3.7.11Not reportedNVD-CVE-2022-0391Not reported
CpepythoncpeNot reported3.8.11Not reportedNVD-CVE-2022-0391Not reported
CpepythoncpeNot reported3.9.5Not reportedNVD-CVE-2022-0391Not reported
Ubuntupython2.7debpro2.7.18-13ubuntu1.1+esm2Not reportedUBUNTU-CVE-2022-0391Not reported
Ubuntupython3.4debpro3.4.3-1ubuntu1~14.04.7+esm12Not reportedUBUNTU-CVE-2022-0391Not reported
Ubuntupython3.5debpro3.5.2-2ubuntu0~16.04.13+esm2Not reportedUBUNTU-CVE-2022-0391Not reported
Ubuntupython2.7deb18.042.7.17-1~18.04ubuntu1.7Not reportedUBUNTU-CVE-2022-0391Not reported
Ubuntupython3.6deb18.043.6.9-1~18.04ubuntu1.7Not reportedUBUNTU-CVE-2022-0391Not reported
Ubuntupython3.7debpro3.7.5-2ubuntu1~18.04.2+esm3Not reportedUBUNTU-CVE-2022-0391Not reported
Ubuntupython3.8debpro3.8.0-3ubuntu1~18.04.2+esm2Not reportedUBUNTU-CVE-2022-0391Not reported
Ubuntupython3.8deb20.043.8.10-0ubuntu1~20.04.4Not reportedUBUNTU-CVE-2022-0391Not reported
Opensusepythonrpmtumbleweed2.7.18-16.1Not reportedOPENSUSE-SU-2024:11839-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [pypy3]Fixed
    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

    • 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

  • [pypy3-dev]Fixed

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

  • [pypy3-doc]Fixed

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

  • [pypy3-lib]Fixed

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

    • 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

  • Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

  • [pypy3-tk]Fixed

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

    • 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

  • [pypy3-venv]Fixed

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Fixed · Fixed: 7.3.6+dfsg-1

      nvd · pypy3 · debian · bookworm

Observed:

References