CRITICAL✓ PATCH🇬🇧 English

CVE-2019-9636

CVSS 9.8v3.1pub. 2019-03-08upd. 2024-11-21

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

oryginał EN

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Canonical Ubuntu
OS
Canonical
12.0414.0416.0418.0419.04
Debian
OS
Debian
8.09.0
Fedora Project Fedora
OS
Fedoraproject
28293031
Opensuse Leap
OS
Opensuse
15.015.142.3
Oracle Sun Zfs Storage Appliance Kit
APP
Oracle
8.8.6
Python
APP
Python
2.7.0 – 2.7.17 (bez)3.0.0 – 3.4.10 (bez)3.5.0 – 3.5.7 (bez)3.6.0 – 3.6.9 (bez)3.7.0 – 3.7.3 (bez)
Red Hat Enterprise Linux
OS
Redhat
7.07.58.0
Red Hat Enterprise Linux Desktop
OS
Redhat
6.0
Red Hat Enterprise Linux Eus
OS
Redhat
7.58.18.28.48.6
Red Hat Enterprise Linux Server
OS
Redhat
6.0
Red Hat Enterprise Linux Server Aus
OS
Redhat
7.48.28.4
Red Hat Enterprise Linux Server Eus
OS
Redhat
5.6
Red Hat Enterprise Linux Server Tus
OS
Redhat
7.48.28.48.6
Red Hat Enterprise Linux Workstation
OS
Redhat
6.0
Red Hat OpenShift Container Platform
APP
Redhat
3.11
Red Hat Virtualization
APP
Redhat
4.0