Detections
Analytics

Google: dev-lang/python: security update to 17162.210.48

critical Tenable Self-Hosted Container Security Plugin ID 452025

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A security regression of CVE-2019-9636 was discovered in python since commit
 d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through
 v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts
 of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or
 other kind of information, it is possible for an attacker to provide specially crafted URLs to make the
 application locate host-related information (e.g. cookies, authentication data) and send them to a
 different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack
 may vary based on the application. (CVE-2019-10160)

Solution

Update the dev-lang/python library and its related packages to version 17162.210.48 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-101.oval.xml.tar.gz

Plugin Details

Severity: Critical

ID: 452025

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 97.35

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2019-10160

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/7/2019

Reference Information

CVE: CVE-2019-10160