NetSight
IP …
critical9.8

CVE-2019-9636

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization.

Impact

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Affected products

VendorProductAffected versions
PythonPython
from 2.7.0 before 2.7.17
from 3.0.0 before 3.4.10
from 3.5.0 before 3.5.7
from 3.6.0 before 3.6.9
from 3.7.0 before 3.7.3
FedoraprojectFedora
Versions 28, 29, 30, 31
OpensuseLeap
Versions 15.0, 15.1, 42.3
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 19.04
RedhatOpenshift Container Platform
Version 3.11
RedhatEnterprise Linux
Versions 7.5, 8.0
RedhatEnterprise Linux Desktop
Version 6.0
RedhatEnterprise Linux Eus
Versions 7.5, 8.1, 8.2, 8.4, 8.6
RedhatEnterprise Linux Server
Version 6.0
RedhatEnterprise Linux Server Aus
Versions 7.4, 8.2, 8.4
RedhatEnterprise Linux Server Eus
Version 5.6

Weakness classification

CWE-173

References