Python 2.x < 2.7.17, 3.x < 3.5.8, 3.6.x < 3.6.9, 3.7.x < 3.7.4 HTTP Header Injection Vulnerability (bpo-30458) - Mac OS X

Python is prone to a HTTP header injection vulnerability (follow-up of CVE-2016-5699).

The following vulnerabilities exist: - CVE-2019-9740: An issue was discovered in urllib2 in Python 2.x and urllib in Python 3.x. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to 'urllib.request.urlopen' with 'rn' (specifically in the query string after a '?' character) followed by an HTTP header or a Redis command. - CVE-2019-9947: An issue was discovered in urllib2 in Python 2.x and urllib in Python 3.x. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to 'urllib.request.urlopen' with 'rn' (specifically in the path component of a URL that lacks a '?' character) followed by an HTTP header or a Redis command.

Python versions 2.x prior to 2.7.17, 3.x prior to 3.5.8, 3.6.x prior to 3.6.9 and 3.7.x prior to 3.7.4.

Checks if a vulnerable version is present on the target host.

The vendor has released updates. Please see the references for more information.