CVE-2019-10160
CVE-2019-10160
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
CVSS 9.8 · Critique · EPSS 5,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system · python
Produits et versions concernés
python
- Versions du logiciel
- affects 2.7, 3.5, 3.6, 3.7, >= v3.8.0a4 and < v3.8.0b1: Concernée
Aucun correctif publié
python2.7 Debian:11
- Plages de versions concernées
- ECOSYSTEM: < 2.7.16-3
Mettez à jour vers 2.7.16-3
python2.7 Ubuntu:Pro:14.04:LTS
- Versions du logiciel
- 2.7.5-8ubuntu3
- 2.7.5-8ubuntu4
- 2.7.6-2
- 2.7.6-2ubuntu1
- 2.7.6-3
- 2.7.6-3ubuntu1
- 2.7.6-4
- 2.7.6-4ubuntu1
- 2.7.6-5
- 2.7.6-7
- 2.7.6-8
- 2.7.6-8ubuntu0.2
- 2.7.6-8ubuntu0.3
- 2.7.6-8ubuntu0.4
- 2.7.6-8ubuntu0.5
- Plages de versions concernées
- ECOSYSTEM: < 2.7.6-8ubuntu0.6+esm2
Mettez à jour vers 2.7.6-8ubuntu0.6+esm2
python3.4 Ubuntu:Pro:14.04:LTS
- Versions du logiciel
- 3.4~b1-0ubuntu3
- 3.4~b1-4ubuntu4
- 3.4~b1-4ubuntu6
- 3.4~b1-5ubuntu2
- 3.4~b2-1
- 3.4~b3-1ubuntu1
- 3.4~rc1-1build1
- 3.4~rc2-1
- 3.4~rc3-0ubuntu1
- 3.4.0-1
- 3.4.0-2ubuntu1
- 3.4.0-2ubuntu1.1
- 3.4.3-1ubuntu1~14.04.1
- 3.4.3-1ubuntu1~14.04.3
- 3.4.3-1ubuntu1~14.04.4
- 3.4.3-1ubuntu1~14.04.5
- 3.4.3-1ubuntu1~14.04.6
- 3.4.3-1ubuntu1~14.04.7
- Plages de versions concernées
- ECOSYSTEM: < 3.4.3-1ubuntu1~14.04.7+esm2
Mettez à jour vers 3.4.3-1ubuntu1~14.04.7+esm2
python3.5 Ubuntu:Pro:14.04:LTS
- Versions du logiciel
- 3.5.2-2ubuntu0~16.04.4~14.04.1
- Plages de versions concernées
- ECOSYSTEM: < 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
Mettez à jour vers 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
python2.7 Ubuntu:16.04:LTS
- Versions du logiciel
- 2.7.10-4ubuntu1
- 2.7.10-4ubuntu2
- 2.7.11-2
- 2.7.11-3
- 2.7.11-4
- 2.7.11-6
- 2.7.11-7
- 2.7.11-7ubuntu1
- 2.7.12-1~16.04
- 2.7.12-1ubuntu0~16.04.1
- 2.7.12-1ubuntu0~16.04.2
- 2.7.12-1ubuntu0~16.04.3
- 2.7.12-1ubuntu0~16.04.4
- Plages de versions concernées
- ECOSYSTEM: < 2.7.12-1ubuntu0~16.04.8
Mettez à jour vers 2.7.12-1ubuntu0~16.04.8
python3.5 Ubuntu:16.04:LTS
- Versions du logiciel
- 3.5.0-3
- 3.5.0-3ubuntu1
- 3.5.1~rc1-2ubuntu1
- 3.5.1-1
- 3.5.1-2
- 3.5.1-3
- 3.5.1-5
- 3.5.1-6ubuntu1
- 3.5.1-6ubuntu2
- 3.5.1-9ubuntu1
- 3.5.1-10
- 3.5.2-2~16.01
- 3.5.2-2~16.04
- 3.5.2-2ubuntu0~16.04.1
- 3.5.2-2ubuntu0~16.04.2
- 3.5.2-2ubuntu0~16.04.3
- 3.5.2-2ubuntu0~16.04.4
- 3.5.2-2ubuntu0~16.04.5
- Plages de versions concernées
- ECOSYSTEM: < 3.5.2-2ubuntu0~16.04.8
Mettez à jour vers 3.5.2-2ubuntu0~16.04.8
python2.7 Ubuntu:18.04:LTS
- Versions du logiciel
- 2.7.14-2ubuntu2
- 2.7.14-4
- 2.7.14-6
- 2.7.14-7
- 2.7.14-8
- 2.7.15~rc1-1
- 2.7.15~rc1-1ubuntu0.1
- 2.7.15-4ubuntu4~18.04
- Plages de versions concernées
- ECOSYSTEM: < 2.7.15-4ubuntu4~18.04.1
Mettez à jour vers 2.7.15-4ubuntu4~18.04.1
python3.6 Ubuntu:18.04:LTS
- Versions du logiciel
- 3.6.3-1ubuntu1
- 3.6.4~rc1-1
- 3.6.4~rc1-2
- 3.6.4-1
- 3.6.4-2
- 3.6.4-3build1
- 3.6.4-4
- 3.6.5~rc1-1
- 3.6.5-3
- 3.6.6-1~18.04
- 3.6.7-1~18.04
- 3.6.8-1~18.04.1
- Plages de versions concernées
- ECOSYSTEM: < 3.6.8-1~18.04.2
Mettez à jour vers 3.6.8-1~18.04.2
Sources originales
- https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160
- https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e
- https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de
- https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09
- https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468
- https://security.netapp.com/advisory/ntap-20190617-0003/
- https://access.redhat.com/errata/RHSA-2019:1587
- https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html
- https://access.redhat.com/errata/RHSA-2019:1700
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/
- https://access.redhat.com/errata/RHSA-2019:2437
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html
- https://usn.ubuntu.com/4127-2/
- https://usn.ubuntu.com/4127-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
- https://nvd.nist.gov/vuln/detail/CVE-2019-10160