{"action":"Upgrade urllib3 to 1.24.3 or later.","affected":[{"fixed":"1.24.3","introduced":"0"}],"component":"urllib3","cve_ids":["CVE-2019-11236"],"ecosystem":"PyPI","epss":0.02073,"exploited":false,"fixed_versions":["1.24.3"],"ghsa_id":"GHSA-r64q-w8jr-g9qp","id":"tcs_01M5KG8GG30M3ZDG7Z4GVRC05C","modified_at":"2023-11-08T04:01:00.047784Z","published_at":"2019-04-15T15:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-132","https://github.com/urllib3/urllib3/issues/1553","https://usn.ubuntu.com/3990-1/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR/","https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html","https://usn.ubuntu.com/3990-2/","https://access.redhat.com/errata/RHSA-2019:2272","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3590","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/","https://github.com/advisories/GHSA-r64q-w8jr-g9qp"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-132","url":"https://osv.dev/vulnerability/PYSEC-2019-132"}],"summary":"In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter."}