CVE-2022-0391: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 8.3% chance of exploitation in the next 30 days.

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Affected products

• Fedoraproject Fedora: version 34 only; version 35 only
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Hci: affected versions not specified
• Netapp Hci Compute Node: affected versions not specified
• Netapp Management Services For Element Software: affected versions not specified
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Netapp Solidfire, Enterprise Sds & Hci Storage Node: affected versions not specified
• Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only
• Python Python: before 3.6.14 (fixed in 3.6.14); from 3.7.0, before 3.7.11 (fixed in 3.7.11); from 3.8.0, before 3.8.11 (fixed in 3.8.11); from 3.9.0, before 3.9.5 (fixed in 3.9.5); version 3.10.0 only

Published 2022-02-09. Last modified 2026-06-17.