NetSight
IP …
critical9.1

CVE-2019-9948

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist …

Impact

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

Affected products

VendorProductAffected versions
PythonPython
from 2.0 before 2.7.17
from 3.5.0 before 3.5.8
from 3.6.0 before 3.6.9
from 3.7.0 before 3.7.4
OpensuseLeap
Versions 15.0, 42.3
DebianDebian Linux
Versions 8.0, 9.0
FedoraprojectFedora
Versions 29, 30
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 19.04
RedhatEnterprise Linux Desktop
Versions 7.0, 8.0
RedhatEnterprise Linux Eus
Versions 8.1, 8.2, 8.4, 8.6
RedhatEnterprise Linux Server
Versions 7.0, 8.0
RedhatEnterprise Linux Server Eus
Version 8.4
RedhatEnterprise Linux Tus
Versions 8.2, 8.4, 8.6
RedhatEnterprise Linux Workstation
Versions 7.0, 8.0

Weakness classification

CWE-22

References