Kritik CVSS 9.8

CVE-2019-10160: Python: güvenlik açığı

Yayın: 7 Haziran 2019 21:29 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: %5,23 (yüzdelik 93)
CWE: CWE-172
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	2.7.0	—	2.7.17
python-python	3.5.0	—	3.5.8
python-python	3.6.0	—	3.6.9
python-python	3.7.0	—	3.7.4
python-python	3.8.0	3.8.0	—
python-python	3.8.0	3.8.0	—
redhat-enterprise-linux-desktop	7.0	7.0	—
redhat-enterprise-linux-eus	7.6	7.6	—
redhat-enterprise-linux-server	7.0	7.0	—
redhat-enterprise-linux-server-aus	7.6	7.6	—
redhat-enterprise-linux-server-tus	7.6	7.6	—
redhat-enterprise-linux-workstation	7.0	7.0	—
debian-debian-linux	8.0	8.0	—
debian-debian-linux	9.0	9.0	—
opensuse-leap	15.0	15.0	—
opensuse-leap	15.1	15.1	—
fedoraproject-fedora	29	29	—
fedoraproject-fedora	30	30	—
fedoraproject-fedora	31	31	—
canonical-ubuntu-linux	12.04	12.04	—
canonical-ubuntu-linux	14.04	14.04	—
canonical-ubuntu-linux	16.04	16.04	—
canonical-ubuntu-linux	18.04	18.04	—
canonical-ubuntu-linux	19.04	19.04	—
redhat-virtualization	4.0	4.0	—
netapp-cloud-backup	—	—	—
netapp-converged-systems-advisor-agent	—	—	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları