CVE-2019-9636

Severity

50%

Complexity

99%

Confidentiality

48%

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.

CVSS 3.0 Base Score 9.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N).

Overview

First reported 5 years ago

2019-03-08 21:29:00

Last updated 5 years ago

2019-06-13 16:29:00

Affected Software

Python

Fedora 28

28

Fedora 29

29

Fedora 30

30

Red Hat Enterprise Linux 6.5

6.5

Red Hat Enterprise Linux (RHEL) 7.0 (7)

7.0

Red Hat Enterprise Linux 7.4

7.4

Red Hat Enterprise Linux 7.5

7.5

Red Hat Enterprise Linux 7.6

7.6

RedHat Enterprise Linux Desktop 7.0

7.0

RedHat Enterprise Linux Server 7.0

7.0

Red Hat Enterprise Linux Server Advanced mission critical Update Support (AUS) 7.6

7.6

Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.6

7.6

Red Hat Enterprise Linux Server Telecommunications Update Service (TUS) 7.6

7.6

RedHat Enterprise Linux Workstation 7.0

7.0

openSUSE Leap 15.0

15.0

References

openSUSE-SU-2019:1273

Mailing List, Third Party Advisory

openSUSE-SU-2019:1282

Mailing List, Third Party Advisory

openSUSE-SU-2019:1371

openSUSE-SU-2019:1580

openSUSE-SU-2019:1906

openSUSE-SU-2020:0086

107400

Third Party Advisory, VDB Entry

RHBA-2019:0763

RHBA-2019:0764

RHBA-2019:0959

RHSA-2019:0710

Third Party Advisory

RHSA-2019:0765

Third Party Advisory

RHSA-2019:0806

Third Party Advisory

RHSA-2019:0902

Third Party Advisory

RHSA-2019:0981

RHSA-2019:0997

RHSA-2019:1467

RHSA-2019:2980

RHSA-2019:3170

https://bugs.python.org/issue36216

Issue Tracking, Patch, Vendor Advisory

https://github.com/python/cpython/pull/12201

Patch, Third Party Advisory

[debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update

[debian-lts-announce] 20190625 [SECURITY] [DLA 1835-1] python3.4 security update

FEDORA-2019-7df59302e0

FEDORA-2019-7723d4774a

FEDORA-2019-51f1e08207

Mailing List, Release Notes, Third Party Advisory

FEDORA-2019-57462fa10d

FEDORA-2019-cf725dd20b

Mailing List, Release Notes, Third Party Advisory

FEDORA-2019-a122fe704d

Mailing List, Release Notes, Third Party Advisory

FEDORA-2019-6baeb15da3

Mailing List, Release Notes, Third Party Advisory

FEDORA-2019-2b1f72899a

FEDORA-2019-5dc275c9f2

FEDORA-2019-60a1defcd1

FEDORA-2019-6b02154aa0

Mailing List, Release Notes, Third Party Advisory

FEDORA-2019-86f32cbab1

Mailing List, Release Notes, Third Party Advisory

FEDORA-2019-d202cda4f8

FEDORA-2019-ec26883852

FEDORA-2019-6e1938a3c5

Mailing List, Release Notes, Third Party Advisory

FEDORA-2019-1ffd6b6064

FEDORA-2019-9bfb4a3e4b

FEDORA-2019-243442e600

Mailing List, Release Notes, Third Party Advisory

FEDORA-2019-b06ec6159b

FEDORA-2019-7d9f3cf3ce

Mailing List, Release Notes, Third Party Advisory

https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html

Patch, Third Party Advisory

GLSA-202003-26

https://security.netapp.com/advisory/ntap-20190517-0001/

USN-4127-1

USN-4127-2

https://www.oracle.com/security-alerts/cpujan2020.html

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.