Kritik CVSS 9.1 PoC var

CVE-2019-9948: Python: dizin geçişi

Yayın: 23 Mart 2019 21:29 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: %11,84 (yüzdelik 96)
CWE: CWE-22
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	2.0	—	2.7.17
python-python	3.5.0	—	3.5.8
python-python	3.6.0	—	3.6.9
python-python	3.7.0	—	3.7.4
opensuse-leap	15.0	15.0	—
opensuse-leap	42.3	42.3	—
debian-debian-linux	8.0	8.0	—
debian-debian-linux	9.0	9.0	—
fedoraproject-fedora	29	29	—
fedoraproject-fedora	30	30	—
canonical-ubuntu-linux	12.04	12.04	—
canonical-ubuntu-linux	14.04	14.04	—
canonical-ubuntu-linux	16.04	16.04	—
canonical-ubuntu-linux	18.04	18.04	—
canonical-ubuntu-linux	19.04	19.04	—
redhat-enterprise-linux-desktop	7.0	7.0	—
redhat-enterprise-linux-desktop	8.0	8.0	—
redhat-enterprise-linux-eus	8.1	8.1	—
redhat-enterprise-linux-eus	8.2	8.2	—
redhat-enterprise-linux-eus	8.4	8.4	—
redhat-enterprise-linux-eus	8.6	8.6	—
redhat-enterprise-linux-server	7.0	7.0	—
redhat-enterprise-linux-server	8.0	8.0	—
redhat-enterprise-linux-server-eus	8.4	8.4	—
redhat-enterprise-linux-tus	8.2	8.2	—
redhat-enterprise-linux-tus	8.4	8.4	—
redhat-enterprise-linux-tus	8.6	8.6	—
redhat-enterprise-linux-workstation	7.0	7.0	—
redhat-enterprise-linux-workstation	8.0	8.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları