9.8
Critical
CVE-2019-10160 A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3…
Description
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| python | Versions not published | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
References
- python-security.readthedocs.io python-security.readthedocs.io
- bugzilla.redhat.com bugzilla.redhat.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- security.netapp.com security.netapp.com
- RHSA-2019:1587 access.redhat.com
- [debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update lists.debian.org
- RHSA-2019:1700 access.redhat.com
- FEDORA-2019-7723d4774a lists.fedoraproject.org
- FEDORA-2019-7df59302e0 lists.fedoraproject.org
- FEDORA-2019-9bfb4a3e4b lists.fedoraproject.org
- FEDORA-2019-60a1defcd1 lists.fedoraproject.org
- RHSA-2019:2437 access.redhat.com
- openSUSE-SU-2019:1906 lists.opensuse.org
- USN-4127-2 usn.ubuntu.com
- USN-4127-1 usn.ubuntu.com
- FEDORA-2019-50772cf122 lists.fedoraproject.org
- FEDORA-2019-5dc275c9f2 lists.fedoraproject.org
- FEDORA-2019-2b1f72899a lists.fedoraproject.org
- FEDORA-2019-b06ec6159b lists.fedoraproject.org
- FEDORA-2019-d202cda4f8 lists.fedoraproject.org
- FEDORA-2019-57462fa10d lists.fedoraproject.org
- openSUSE-SU-2020:0086 lists.opensuse.org
- [debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update lists.debian.org
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image lists.apache.org
- [debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update lists.debian.org
Timeline
- Published
- Last modified