CVE-2019-9947

CVE-2019-9947 describes a CRLF injection vulnerability in Python's urllib2 (Python 2.x) and urllib (Python 3.x) libraries, affecting versions up to 2.7.16 and 3.7.3 respectively. An attacker can inject carriage return and line feed characters into HTTP headers or Redis commands by controlling a URL parameter, specifically in the path component of a URL lacking a question mark. This vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to limited confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.