CVE-2022-0391

Description

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like and in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
1.321

Associated Vulnerability

VulnerabilityOS Platform
Vulnerability CVE-2021-3733,CVE-2022-0391 are affected in Python 3.10.0Windows
Multiple Vulnerabilities are affected in Python 3.10.0Windows
Multiple Vulnerabilities are affected in IBM Tivoli Application Dependency Discovery Manager 7.3.0.9Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.1Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2Windows
An interactive high-level object-oriented language (USN-5342-1) python2.7_2.7.17-1~18.04ubuntu1.8_i386.debLinux
An interactive high-level object-oriented language (USN-5342-1) python2.7_2.7.17-1~18.04ubuntu1.8_amd64.debLinux
An interactive high-level object-oriented language (USN-5342-1) python3.6_3.6.9-1~18.04ubuntu1.8_i386.debLinux
An interactive high-level object-oriented language (USN-5342-1) python3.6_3.6.9-1~18.04ubuntu1.8_amd64.debLinux
An interactive high-level object-oriented language (USN-5342-1) python3.8_3.8.10-0ubuntu1~20.04.5_i386.debLinux
An interactive high-level object-oriented language (USN-5342-1) python3.8_3.8.10-0ubuntu1~20.04.5_amd64.debLinux
An interactive high-level object-oriented language (USN-5342-1) python2.7-minimal_2.7.17-1~18.04ubuntu1.8_i386.debLinux
An interactive high-level object-oriented language (USN-5342-1) python2.7-minimal_2.7.17-1~18.04ubuntu1.8_amd64.debLinux
An interactive high-level object-oriented language (USN-5342-1) python3.6-minimal_3.6.9-1~18.04ubuntu1.8_i386.debLinux
An interactive high-level object-oriented language (USN-5342-1) python3.6-minimal_3.6.9-1~18.04ubuntu1.8_amd64.debLinux
An interactive high-level object-oriented language (USN-5342-1) python3.8-minimal_3.8.10-0ubuntu1~20.04.5_i386.debLinux
An interactive high-level object-oriented language (USN-5342-1) python3.8-minimal_3.8.10-0ubuntu1~20.04.5_amd64.debLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) libpython3_4m1_0-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) libpython3_4m1_0-32bit-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) libpython3_4m1_0-debuginfo-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) libpython3_4m1_0-debuginfo-32bit-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-3.4.10-25.85.2.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-base-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-base-debuginfo-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-base-debuginfo-32bit-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-base-debugsource-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-curses-3.4.10-25.85.2.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-curses-debuginfo-3.4.10-25.85.2.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-debuginfo-3.4.10-25.85.2.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-debugsource-3.4.10-25.85.2.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-devel-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-devel-debuginfo-3.4.10-25.85.1.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-tk-3.4.10-25.85.2.x86_64.rpmLinux
SUSE-SU-2022:0882-1(SUSE Linux Enterprise Server 12-SP5 ) python3-tk-debuginfo-3.4.10-25.85.2.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) libpython2_7-1_0-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) libpython2_7-1_0-32bit-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) libpython2_7-1_0-debuginfo-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) libpython2_7-1_0-debuginfo-32bit-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-32bit-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-32bit-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-debuginfo-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-debuginfo-32bit-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-base-debugsource-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-curses-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-curses-debuginfo-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-debuginfo-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-debuginfo-32bit-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-debugsource-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-demo-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-devel-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-doc-2.7.18-33.8.1.noarch.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-doc-pdf-2.7.18-33.8.1.noarch.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-gdbm-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-gdbm-debuginfo-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-idle-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-tk-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-tk-debuginfo-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-xml-2.7.18-33.8.1.x86_64.rpmLinux
SUSE-SU-2022:1140-1(SUSE Linux Enterprise Server 12-SP5 ) python-xml-debuginfo-2.7.18-33.8.1.x86_64.rpmLinux
(RHSA-2022:1764) python38:3.8 and python38-devel:3.8 security update python-lxml-debugsource-4.4.1-7.module+el8.6.0+13958+214a5473.x86_64.rpmLinux
(RHSA-2022:1764) python38:3.8 and python38-devel:3.8 security update python38-debug-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpmLinux
(RHSA-2022:1764) python38:3.8 and python38-devel:3.8 security update python38-debugsource-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpmLinux
(RHSA-2022:1764) python38:3.8 and python38-devel:3.8 security update python38-devel-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpmLinux
(RHSA-2022:1764) python38:3.8 and python38-devel:3.8 security update python38-idle-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpmLinux
(RHSA-2022:1764) python38:3.8 and python38-devel:3.8 security update python38-lxml-4.4.1-7.module+el8.6.0+13958+214a5473.x86_64.rpmLinux
(RHSA-2022:1764) python38:3.8 and python38-devel:3.8 security update python38-rpm-macros-3.8.12-1.module+el8.6.0+12642+c3710b74.noarch.rpmLinux
(RHSA-2022:1764) python38:3.8 and python38-devel:3.8 security update python38-test-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpmLinux
(RHSA-2022:1764) python38:3.8 and python38-devel:3.8 security update python38-tkinter-3.8.12-1.module+el8.6.0+12642+c3710b74.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update babel-2.5.1-10.module+el8.5.0+11014+88fc0d0b.noarch.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python-lxml-debugsource-4.2.3-6.module+el8.6.0+13959+8e368262.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python-nose-docs-1.3.7-31.module+el8.5.0+12203+77770ab7.noarch.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python-pymongo-debugsource-3.7.0-1.module+el8.5.0+10264+e5753a40.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-babel-2.5.1-10.module+el8.5.0+11014+88fc0d0b.noarch.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-bson-3.7.0-1.module+el8.5.0+10264+e5753a40.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-debug-2.7.18-10.module+el8.6.0+14191+7fdd52cd.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-debugsource-2.7.18-10.module+el8.6.0+14191+7fdd52cd.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-devel-2.7.18-10.module+el8.6.0+14191+7fdd52cd.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-jinja2-2.10-9.module+el8.5.0+10541+706bb066.noarch.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-lxml-4.2.3-6.module+el8.6.0+13959+8e368262.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-nose-1.3.7-31.module+el8.5.0+12203+77770ab7.noarch.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-pygments-2.2.0-22.module+el8.5.0+10788+a4cea9e0.noarch.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-pymongo-3.7.0-1.module+el8.5.0+10264+e5753a40.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-pymongo-gridfs-3.7.0-1.module+el8.5.0+10264+e5753a40.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-scipy-1.0.0-21.module+el8.5.0+10858+05337455.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-test-2.7.18-10.module+el8.6.0+14191+7fdd52cd.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-tkinter-2.7.18-10.module+el8.6.0+14191+7fdd52cd.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-tools-2.7.18-10.module+el8.6.0+14191+7fdd52cd.x86_64.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-virtualenv-15.1.0-21.module+el8.5.0+12203+77770ab7.noarch.rpmLinux
(RHSA-2022:1821) python27:2.7 security update python2-wheel-wheel-0.31.1-3.module+el8.5.0+12203+77770ab7.noarch.rpmLinux
(RHSA-2022:1821) python27:2.7 security update scipy-debugsource-1.0.0-21.module+el8.5.0+10858+05337455.x86_64.rpmLinux
Python update (ELSA-2022-5235) python-2.7.5-92.0.1.el7_9.x86_64.rpmLinux
Python-debug update (ELSA-2022-5235) python-debug-2.7.5-92.0.1.el7_9.x86_64.rpmLinux
Python-devel update (ELSA-2022-5235) python-devel-2.7.5-92.0.1.el7_9.x86_64.rpmLinux
Python-libs update (ELSA-2022-5235) python-libs-2.7.5-92.0.1.el7_9.i686.rpmLinux
Python-libs update (ELSA-2022-5235) python-libs-2.7.5-92.0.1.el7_9.x86_64.rpmLinux
Python-test update (ELSA-2022-5235) python-test-2.7.5-92.0.1.el7_9.x86_64.rpmLinux
Python-tools update (ELSA-2022-5235) python-tools-2.7.5-92.0.1.el7_9.x86_64.rpmLinux
Tkinter update (ELSA-2022-5235) tkinter-2.7.5-92.0.1.el7_9.x86_64.rpmLinux
Platform-python update (ELSA-2022-6457) platform-python-3.6.8-47.0.1.el8_6.i686.rpmLinux
Platform-python update (ELSA-2022-6457) platform-python-3.6.8-47.0.1.el8_6.x86_64.rpmLinux
Platform-python-debug update (ELSA-2022-6457) platform-python-debug-3.6.8-47.0.1.el8_6.i686.rpmLinux
Platform-python-debug update (ELSA-2022-6457) platform-python-debug-3.6.8-47.0.1.el8_6.x86_64.rpmLinux
Platform-python-devel update (ELSA-2022-6457) platform-python-devel-3.6.8-47.0.1.el8_6.i686.rpmLinux
Platform-python-devel update (ELSA-2022-6457) platform-python-devel-3.6.8-47.0.1.el8_6.x86_64.rpmLinux
Python3-idle update (ELSA-2022-6457) python3-idle-3.6.8-47.0.1.el8_6.i686.rpmLinux
Python3-idle update (ELSA-2022-6457) python3-idle-3.6.8-47.0.1.el8_6.x86_64.rpmLinux
Python3-libs update (ELSA-2022-6457) python3-libs-3.6.8-47.0.1.el8_6.i686.rpmLinux
Python3-libs update (ELSA-2022-6457) python3-libs-3.6.8-47.0.1.el8_6.x86_64.rpmLinux
Python3-test update (ELSA-2022-6457) python3-test-3.6.8-47.0.1.el8_6.i686.rpmLinux
Python3-test update (ELSA-2022-6457) python3-test-3.6.8-47.0.1.el8_6.x86_64.rpmLinux
Python3-tkinter update (ELSA-2022-6457) python3-tkinter-3.6.8-47.0.1.el8_6.i686.rpmLinux
Python3-tkinter update (ELSA-2022-6457) python3-tkinter-3.6.8-47.0.1.el8_6.x86_64.rpmLinux
(RHSA-2022:6457) python3 security update platform-python-3.6.8-47.el8_6.i686.rpmLinux
(RHSA-2022:6457) python3 security update platform-python-3.6.8-47.el8_6.x86_64.rpmLinux
(RHSA-2022:6457) python3 security update platform-python-debug-3.6.8-47.el8_6.i686.rpmLinux
(RHSA-2022:6457) python3 security update platform-python-debug-3.6.8-47.el8_6.x86_64.rpmLinux
(RHSA-2022:6457) python3 security update platform-python-devel-3.6.8-47.el8_6.i686.rpmLinux
(RHSA-2022:6457) python3 security update platform-python-devel-3.6.8-47.el8_6.x86_64.rpmLinux
(RHSA-2022:6457) python3 security update python3-debugsource-3.6.8-47.el8_6.i686.rpmLinux
(RHSA-2022:6457) python3 security update python3-debugsource-3.6.8-47.el8_6.x86_64.rpmLinux
(RHSA-2022:6457) python3 security update python3-idle-3.6.8-47.el8_6.i686.rpmLinux
(RHSA-2022:6457) python3 security update python3-idle-3.6.8-47.el8_6.x86_64.rpmLinux
(RHSA-2022:6457) python3 security update python3-libs-3.6.8-47.el8_6.i686.rpmLinux
(RHSA-2022:6457) python3 security update python3-libs-3.6.8-47.el8_6.x86_64.rpmLinux
(RHSA-2022:6457) python3 security update python3-test-3.6.8-47.el8_6.i686.rpmLinux
(RHSA-2022:6457) python3 security update python3-test-3.6.8-47.el8_6.x86_64.rpmLinux
(RHSA-2022:6457) python3 security update python3-tkinter-3.6.8-47.el8_6.i686.rpmLinux
(RHSA-2022:6457) python3 security update python3-tkinter-3.6.8-47.el8_6.x86_64.rpmLinux
python2 update (TU-CESAS-0001) python2-2.7.18-12.module_el8+299+aa6e9afa.x86_64.rpmLinux
python2 update (TU-CESAS-0001) python2-libs-2.7.18-12.module_el8+299+aa6e9afa.x86_64.rpmLinux
python2 update (TU-CESAS-0001) python2-test-2.7.18-12.module_el8+299+aa6e9afa.x86_64.rpmLinux
python2 update (TU-CESAS-0001) python2-babel-2.5.1-10.module_el8+299+aa6e9afa.noarch.rpmLinux
python2 update (TU-CESAS-0001) python2-debug-2.7.18-12.module_el8+299+aa6e9afa.x86_64.rpmLinux
python2 update (TU-CESAS-0001) python2-devel-2.7.18-12.module_el8+299+aa6e9afa.x86_64.rpmLinux
python2 update (TU-CESAS-0001) python2-tkinter-2.7.18-12.module_el8+299+aa6e9afa.x86_64.rpmLinux
postgresql update (TU-CESAS-0001) postgresql-test-rpm-macros-10.23-1.module_el8+300+2c53004c.x86_64.rpmLinux
python2 update (TU-CESAS-0002) python2-lxml-4.2.3-6.module_el8+299+aa6e9afa.x86_64.rpmLinux
python2 update (TU-CESAS-0002) python2-tools-2.7.18-12.module_el8+299+aa6e9afa.x86_64.rpmLinux
python2 update (TU-CESAS-0002) python2-jinja2-2.10-9.module_el8+299+aa6e9afa.noarch.rpmLinux
python2 update (TU-CESAS-0002) python2-pygments-2.2.0-22.module_el8+299+aa6e9afa.noarch.rpmLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10_3.10.12-1~22.04.4_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10_3.10.12-1~22.04.4_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10-minimal_3.10.12-1~22.04.4_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.10-minimal_3.10.12-1~22.04.4_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11_3.11.6-3ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11_3.11.6-3ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11-minimal_3.11.6-3ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.11-minimal_3.11.6-3ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12_3.12.0-1ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12_3.12.0-1ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12-minimal_3.12.0-1ubuntu0.1_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.12-minimal_3.12.0-1ubuntu0.1_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8_3.8.10-0ubuntu1~20.04.10_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8_3.8.10-0ubuntu1~20.04.10_i386.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8-minimal_3.8.10-0ubuntu1~20.04.10_amd64.debLinux
An interactive high-level object-oriented language (USN-6891-1) python3.8-minimal_3.8.10-0ubuntu1~20.04.10_i386.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234