When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
Weakness
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | RedHat | python3.12-0:3.12.13-2.el10_2 | * |
| Red Hat Enterprise Linux 8 | RedHat | python3.12-0:3.12.13-2.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.12-0:3.12.13-2.el9_8 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/installer-rhel9:1779798165 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/rhua-rhel9:1779798222 | * |
| Python2.7 | Ubuntu | esm-apps/focal | * |
| Python2.7 | Ubuntu | esm-apps/jammy | * |
| Python2.7 | Ubuntu | esm-infra-legacy/trusty | * |
| Python2.7 | Ubuntu | esm-infra-legacy/xenial | * |
| Python2.7 | Ubuntu | esm-infra/bionic | * |
| Python2.7 | Ubuntu | esm-infra/xenial | * |
| Python2.7 | Ubuntu | jammy | * |
| Python3.10 | Ubuntu | jammy | * |
| Python3.11 | Ubuntu | esm-apps/jammy | * |
| Python3.11 | Ubuntu | jammy | * |
| Python3.12 | Ubuntu | noble | * |
| Python3.13 | Ubuntu | questing | * |
| Python3.13 | Ubuntu | upstream | * |
| Python3.14 | Ubuntu | questing | * |
| Python3.4 | Ubuntu | esm-infra-legacy/trusty | * |
| Python3.5 | Ubuntu | esm-infra-legacy/trusty | * |
| Python3.5 | Ubuntu | esm-infra-legacy/xenial | * |
| Python3.5 | Ubuntu | esm-infra/xenial | * |
| Python3.6 | Ubuntu | esm-infra/bionic | * |
| Python3.7 | Ubuntu | esm-apps/bionic | * |
| Python3.8 | Ubuntu | esm-apps/bionic | * |
| Python3.8 | Ubuntu | esm-infra/focal | * |
| Python3.9 | Ubuntu | esm-apps/focal | * |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172
- https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440
- https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d
- https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca
- https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70
- https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85
- https://github.com/python/cpython/issues/143919
- https://github.com/python/cpython/pull/143920
- https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/