9.1
Critical
CVE-2019-9948 urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to…
Description
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| n/a | Versions not published | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
References
- bugs.python.org bugs.python.org
- github.com github.com
- 107549 www.securityfocus.com
- security.netapp.com security.netapp.com
- openSUSE-SU-2019:1273 lists.opensuse.org
- openSUSE-SU-2019:1580 lists.opensuse.org
- [debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security update lists.debian.org
- RHSA-2019:1700 access.redhat.com
- [debian-lts-announce] 20190711 [SECURITY] [DLA 1852-1] python3.4 security update lists.debian.org
- FEDORA-2019-9bfb4a3e4b lists.fedoraproject.org
- FEDORA-2019-60a1defcd1 lists.fedoraproject.org
- RHSA-2019:2030 access.redhat.com
- USN-4127-2 usn.ubuntu.com
- USN-4127-1 usn.ubuntu.com
- 20191021 [slackware-security] python (SSA:2019-293-01) seclists.org
- packetstormsecurity.com packetstormsecurity.com
- RHSA-2019:3335 access.redhat.com
- RHSA-2019:3520 access.redhat.com
- GLSA-202003-26 security.gentoo.org
- [debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update lists.debian.org
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image lists.apache.org
- [debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of n/a
The 144658 CVEs of n/a →
CVE-2026-106713
An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…
Not rated
CVE-2026-106715
NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin…
Not rated
CVE-2026-106714
Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it…
Not rated
CVE-2026-106716
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep…
Not rated