CVE-2019-10160

critical
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

References

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

https://access.redhat.com/errata/RHSA-2019:1587

https://access.redhat.com/errata/RHSA-2019:1700

https://access.redhat.com/errata/RHSA-2019:2437

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160

https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09

https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e

https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de

https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468

https://lists.apache.org/thread.html/[email protected]%3Cissues.bookkeeper.apache.org%3E

https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html

https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html

https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/

https://lists.fedoraproject.org/archives/list/[email protected]/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/

https://lists.fedoraproject.org/archives/list/[email protected]/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/

https://lists.fedoraproject.org/archives/list/[email protected]/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/

https://lists.fedoraproject.org/archives/list/[email protected]/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/

https://lists.fedoraproject.org/archives/list/[email protected]/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/

https://lists.fedoraproject.org/archives/list/[email protected]/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/

https://lists.fedoraproject.org/archives/list/[email protected]/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/

https://lists.fedoraproject.org/archives/list/[email protected]/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/

https://lists.fedoraproject.org/archives/list/[email protected]/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/

https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html

https://security.netapp.com/advisory/ntap-20190617-0003/

https://usn.ubuntu.com/4127-1/

https://usn.ubuntu.com/4127-2/

Details

Source: MITRE

Published: 2019-06-07

Updated: 2021-01-06

Type: CWE-255

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL

Tenable Plugins

View all (47 total)

IDNameProductFamilySeverity
150669SUSE SLES11 Security Update : python (SUSE-SU-2019:14142-1)NessusSuSE Local Security Checks
critical
139757Debian DLA-2337-1 : python2.7 security updateNessusDebian Local Security Checks
critical
138529Debian DLA-2280-1 : python3.5 security updateNessusDebian Local Security Checks
critical
133448SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0302-1)NessusSuSE Local Security Checks
critical
133259SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)NessusSuSE Local Security Checks
critical
133172openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)NessusSuSE Local Security Checks
critical
133036SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)NessusSuSE Local Security Checks
critical
131244Amazon Linux AMI : python34 (ALAS-2019-1324)NessusAmazon Linux Local Security Checks
critical
130797Fedora 29 : python35 (2019-d202cda4f8)NessusFedora Local Security Checks
critical
130793Fedora 30 : python35 (2019-b06ec6159b)NessusFedora Local Security Checks
critical
130784Fedora 31 : python35 (2019-57462fa10d)NessusFedora Local Security Checks
critical
129618Fedora 31 : python34 (2019-50772cf122)NessusFedora Local Security Checks
high
129212EulerOS 2.0 SP3 : python (EulerOS-SA-2019-2019)NessusHuawei Local Security Checks
critical
129029Fedora 29 : python34 (2019-5dc275c9f2)NessusFedora Local Security Checks
critical
129027Fedora 30 : python34 (2019-2b1f72899a)NessusFedora Local Security Checks
critical
128937EulerOS Virtualization for ARM 64 3.0.2.0 : python (EulerOS-SA-2019-1934)NessusHuawei Local Security Checks
critical
128918EulerOS 2.0 SP2 : python (EulerOS-SA-2019-1866)NessusHuawei Local Security Checks
critical
128631Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : python2.7, python3.5, python3.6, python3.7 vulnerabilities (USN-4127-1)NessusUbuntu Local Security Checks
critical
128089EulerOS 2.0 SP5 : python (EulerOS-SA-2019-1797)NessusHuawei Local Security Checks
critical
128019SUSE SLES12 Security Update : python3 (SUSE-SU-2019:2053-2)NessusSuSE Local Security Checks
critical
127998openSUSE Security Update : python (openSUSE-2019-1906)NessusSuSE Local Security Checks
critical
127986RHEL 7 : Virtualization Manager (RHSA-2019:2437)NessusRed Hat Local Security Checks
medium
127815Amazon Linux AMI : python34 / python35,python36 (ALAS-2019-1259)NessusAmazon Linux Local Security Checks
critical
127814Amazon Linux AMI : python27 (ALAS-2019-1258)NessusAmazon Linux Local Security Checks
critical
127783SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2019:2091-1)NessusSuSE Local Security Checks
critical
127770SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2019:2064-1)NessusSuSE Local Security Checks
critical
127768SUSE SLED12 / SLES12 Security Update : python3 (SUSE-SU-2019:2053-1)NessusSuSE Local Security Checks
critical
127766SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2019:2050-1)NessusSuSE Local Security Checks
critical
127514Fedora 29 : python3 / python3-docs (2019-60a1defcd1)NessusFedora Local Security Checks
critical
127463Amazon Linux 2 : python3 (ALAS-2019-1259)NessusAmazon Linux Local Security Checks
critical
127462Amazon Linux 2 : python (ALAS-2019-1258)NessusAmazon Linux Local Security Checks
critical
127446NewStart CGSL CORE 5.05 / MAIN 5.05 : python Vulnerability (NS-SA-2019-0163)NessusNewStart CGSL Local Security Checks
critical
127440NewStart CGSL CORE 5.04 / MAIN 5.04 : python Vulnerability (NS-SA-2019-0160)NessusNewStart CGSL Local Security Checks
critical
127105Fedora 30 : python3 / python3-docs (2019-9bfb4a3e4b)NessusFedora Local Security Checks
critical
127015EulerOS 2.0 SP8 : python3 (EulerOS-SA-2019-1778)NessusHuawei Local Security Checks
critical
127008EulerOS 2.0 SP8 : python2 (EulerOS-SA-2019-1771)NessusHuawei Local Security Checks
critical
126659Fedora 29 : python36 (2019-7df59302e0)NessusFedora Local Security Checks
critical
126658Fedora 30 : python36 (2019-7723d4774a)NessusFedora Local Security Checks
critical
126222Debian DLA-1834-1 : python2.7 security updateNessusDebian Local Security Checks
critical
126219CentOS 7 : python (CESA-2019:1587)NessusCentOS Local Security Checks
critical
126178Photon OS 1.0: Python3 PHSA-2019-1.0-0240NessusPhotonOS Local Security Checks
high
126177Photon OS 1.0: Python2 PHSA-2019-1.0-0240NessusPhotonOS Local Security Checks
high
126145Scientific Linux Security Update : python on SL7.x x86_64 (20190620)NessusScientific Linux Local Security Checks
critical
126142Oracle Linux 7 : python (ELSA-2019-1587)NessusOracle Linux Local Security Checks
critical
126109Photon OS 2.0: Python3 PHSA-2019-2.0-0165NessusPhotonOS Local Security Checks
critical
126108Photon OS 2.0: Python2 PHSA-2019-2.0-0165NessusPhotonOS Local Security Checks
critical
126089RHEL 7 : python (RHSA-2019:1587)NessusRed Hat Local Security Checks
critical