CVE-2019-10160
07.06.2019, 18:29
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.Enginsight
| Vendor | Product | Version |
|---|---|---|
| python | python | 2.7.0 ≤ 𝑥 < 2.7.17 |
| python | python | 3.5.0 ≤ 𝑥 < 3.5.8 |
| python | python | 3.6.0 ≤ 𝑥 < 3.6.9 |
| python | python | 3.7.0 ≤ 𝑥 < 3.7.4 |
| python | python | 3.8.0:alpha4 |
| python | python | 3.8.0:beta1 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_eus | 7.6 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_server_aus | 7.6 |
| redhat | enterprise_linux_server_tus | 7.6 |
| redhat | enterprise_linux_workstation | 7.0 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| opensuse | leap | 15.0 |
| opensuse | leap | 15.1 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.04 |
| redhat | virtualization | 4.0 |
| netapp | cloud_backup | - |
| netapp | converged_systems_advisor_agent | - |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| python2.7 |
| ||||||||||||||||||||||||||||||
| python3.4 |
| ||||||||||||||||||||||||||||||
| python3.5 |
| ||||||||||||||||||||||||||||||
| python3.6 |
| ||||||||||||||||||||||||||||||
| python3.7 |
|
Common Weakness Enumeration
- CWE-172 - Encoding ErrorThe software does not properly encode or decode the data, resulting in unexpected values.
- CWE-522 - Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
References