CRLF Injection Vulnerability in urllib3 Library for Python

CVE-2019-11236

What is CVE-2019-11236?

The urllib3 library for Python, prior to version 1.24.2, contains a vulnerability that allows for CRLF injection. If an attacker is able to control the parameters in a request, they can inject CRLF sequences, which can lead to HTTP response splitting. This may enable the attacker to manipulate responses sent to clients, potentially allowing for phishing attacks or cookie theft. It is crucial for developers and organizations using urllib3 to update to the latest version to mitigate these risks.

References