CVE-2019-10160 A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which st...
CriticalCVSS 9.8
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/python2.7(Debian:11) | < 2.7.16-3 | 2.7.16-3 |
| python | = affects 2.7, 3.5, 3.6, 3.7, >= v3.8.0a4 and < v3.8.0b1 | No fix listed |
| Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| python | >= 2.7.0, < 2.7.17 | 2.7.17 |
| python | >= 3.5.0, < 3.5.8 | 3.5.8 |
| python | >= 3.6.0, < 3.6.9 | 3.6.9 |
| python | >= 3.7.0, < 3.7.4 | 3.7.4 |
| python | = 3.8.0-alpha4 | No fix listed |
| python | = 3.8.0-beta1 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| openSUSE leap | = 15.0 | No fix listed |
| openSUSE leap | = 15.1 | No fix listed |
| fedoraproject fedora | = 29 | No fix listed |
| fedoraproject fedora | = 30 | No fix listed |
| fedoraproject fedora | = 31 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 19.04 | No fix listed |
| redhat virtualization | = 4.0 | No fix listed |
| netapp cloud backup | All versions | No fix listed |
| netapp converged systems advisor agent | All versions | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- python-security.readthedocs.io patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- security.netapp.com third-party-advisory
- RHSA-2019:1587 third-party-advisory vendor-advisory
- [debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update mailing-list third-party-advisory
- RHSA-2019:1700 third-party-advisory vendor-advisory
- FEDORA-2019-7723d4774a vendor-advisory
- FEDORA-2019-7df59302e0 vendor-advisory
- FEDORA-2019-9bfb4a3e4b vendor-advisory
- FEDORA-2019-60a1defcd1 vendor-advisory
- RHSA-2019:2437 third-party-advisory vendor-advisory
- openSUSE-SU-2019:1906 mailing-list third-party-advisory vendor-advisory
- USN-4127-2 third-party-advisory vendor-advisory
- USN-4127-1 third-party-advisory vendor-advisory
- FEDORA-2019-50772cf122 vendor-advisory
- FEDORA-2019-5dc275c9f2 vendor-advisory
- FEDORA-2019-2b1f72899a vendor-advisory
- FEDORA-2019-b06ec6159b vendor-advisory
- FEDORA-2019-d202cda4f8 vendor-advisory
- FEDORA-2019-57462fa10d vendor-advisory
- openSUSE-SU-2020:0086 mailing-list third-party-advisory vendor-advisory
- [debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update mailing-list third-party-advisory
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update mailing-list third-party-advisory
- cert-portal.siemens.com