Critical · published June 7, 2019
🚨 A sneaky regression in Python could let attackers hijack your data! A crafted URL is all it takes to redirect sensitive information away from where it’s supposed to go. 🔥 Think of it like a mischievous delivery driver who reads a wrong address on a package and sends your private information to the wrong house instead of yours. This misdirection happens because the application misinterprets the URL, much like the driver ignoring the GPS! An attacker could potentially capture cookies, authentication credentials, or other sensitive data by tricking the application into sending it to an unintended host. This could lead to devastating data breaches, allowing unauthorized access to user accounts and private information. Yikes!
Think of it like a mischievous delivery driver who reads a wrong address on a package and sends your private information to the wrong house instead of yours. This misdirection happens because the application misinterprets the URL, much like the driver ignoring the GPS! This vulnerability results from improper parsing of user-supplied URLs, which allows attackers to exploit previously fixed vulnerabilities by manipulating URL components, leading to sensitive data leakage.
An attacker could potentially capture cookies, authentication credentials, or other sensitive data by tricking the application into sending it to an unintended host. This could lead to devastating data breaches, allowing unauthorized access to user accounts and private information. Yikes! Update Python to a secure version (3.8.0b2 or later) to close this vulnerability. Ensure any applications using affected Python versions check for this regression, and audit how user-supplied URLs are handled to prevent similar issues. Don't wait! You've got this! By taking these steps, you can secure your application and keep data safe from prying eyes. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| python/python | ≥ 2.7.0, < 2.7.17 | 2.7.17 |
| python/python | ≥ 3.5.0, < 3.5.8 | 3.5.8 |
| python/python | ≥ 3.6.0, < 3.6.9 | 3.6.9 |
| python/python | ≥ 3.7.0, < 3.7.4 | 3.7.4 |
| python/python | all versions | — |
| python/python | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| opensuse/leap | all versions | — |
| opensuse/leap | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| redhat/virtualization | all versions | — |
| netapp/cloud_backup | all versions | — |
| netapp/converged_systems_advisor_agent | all versions | — |