CVE-2022-0391: fedoraproject fedora

Modified

AliasesUBUNTU-CVE-2022-0391DEBIAN-CVE-2022-0391openSUSE-SU-2024:11839-1

Published 09-02-2022Last modified 14-10-2026

Vulnerability summary

CVE-2022-0391 is a high (CVSS 7.5) vulnerability in fedoraproject fedora. EPSS estimates a 8.54% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

8.54%

0%100%

Low · +0.22 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 16 · Related 7

DLA-3575-1 DLA-3966-1 DLA-4087-1 MGASA-2022-0367 OPENSUSE-SU-2022:1091-1 RHSA-2021:3254+10 more

Timeline

09-02-2022
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

8.54%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

Increase +0.22 pp

From 8.33% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.python.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu7 products

python2.7< 2.7.6-8ubuntu0.6+esm12 | < 2.7.12-1ubuntu0~16.04.18+esm1 | < 2.7.17-1~18.04ubuntu1.7 | < 2.7.18-1~20.04.3+esm1 | < 2.7.18-13ubuntu1.1+esm2
python3.4< 3.4.3-1ubuntu1~14.04.7+esm12
python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.13+esm2
python3.6< 3.6.9-1~18.04ubuntu1.7
python3.7< 3.7.5-2ubuntu1~18.04.2+esm3

Show all 7

Netapp6 products

Show all 6

Oracle2 products

http_server12.2.1.3.0 | 12.2.1.4.0
zfs_storage_appliance_kit8.8

Debian1 product

pypy3< 7.3.6+dfsg-1

Fedoraproject1 product

fedoraEOL34 | 35

Opensuse1 product

python&distro=openSUSE Tumbleweed< 2.7.18-16.1

Python1 product

pythonEOL< 3.6.14 | ≥ 3.7.0, < 3.7.11 | ≥ 3.8.0, < 3.8.11 | ≥ 3.9.0, < 3.9.5 | 3.10.0:alpha1 | 3.10.0:alpha2 | 3.10.0:alpha3 | 3.10.0:alpha4 | 3.10.0:alpha5 | 3.10.0:alpha6

7 vendors · 19 products