When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Weakness
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Python3.10 | Ubuntu | jammy | * |
| Python3.11 | Ubuntu | esm-apps/jammy | * |
| Python3.11 | Ubuntu | jammy | * |
| Python3.12 | Ubuntu | noble | * |
| Python3.13 | Ubuntu | questing | * |
| Python3.14 | Ubuntu | questing | * |
| Python3.4 | Ubuntu | esm-infra-legacy/trusty | * |
| Python3.5 | Ubuntu | esm-infra-legacy/trusty | * |
| Python3.5 | Ubuntu | esm-infra/xenial | * |
| Python3.6 | Ubuntu | esm-infra/bionic | * |
| Python3.7 | Ubuntu | esm-apps/bionic | * |
| Python3.8 | Ubuntu | esm-apps/bionic | * |
| Python3.8 | Ubuntu | esm-infra/focal | * |
| Python3.9 | Ubuntu | esm-apps/focal | * |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172
- https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440
- https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d
- https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca
- https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70
- https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85
- https://github.com/python/cpython/issues/143919
- https://github.com/python/cpython/pull/143920
- https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/