Critical · published March 9, 2019
⚠️ A sneaky Unicode mishap in Python could let attackers read your cookies like an open book! 📖 Think of urllib as a delivery system for URLs, but sometimes it misreads the address—like a post office sending your mail to the wrong house. This little error can lead sensitive info straight to a stranger! If an attacker crafts a specific URL, they could redirect your sensitive data, such as credentials and cookies, to an unauthorized host—imagine handing your house keys to a stranger just because they had a clever story! The potential for information disclosure is absolutely daunting, especially for any applications relying on these Python versions.
Think of urllib as a delivery system for URLs, but sometimes it misreads the address—like a post office sending your mail to the wrong house. This little error can lead sensitive info straight to a stranger! This vulnerability arises from improper handling of Unicode encoding during NFKC normalization in Python's urllib.parse.urlsplit and urlparse functions, allowing attackers to manipulate URL parsing to extract cached data.
If an attacker crafts a specific URL, they could redirect your sensitive data, such as credentials and cookies, to an unauthorized host—imagine handing your house keys to a stranger just because they had a clever story! The potential for information disclosure is absolutely daunting, especially for any applications relying on these Python versions. To protect yourself, ensure you upgrade Python to at least version 2.7.17 or 3.7.3. Review your code and any services using urllib to enforce secure URL handling practices to mitigate this potential risk. You've got this! With a quick update, your security hero status is activated! 🦸♂️
| Product | Versions | Fixed in |
|---|---|---|
| python/python | ≥ 2.7.0, < 2.7.17 | 2.7.17 |
| python/python | ≥ 3.0.0, < 3.4.10 | 3.4.10 |
| python/python | ≥ 3.5.0, < 3.5.7 | 3.5.7 |
| python/python | ≥ 3.6.0, < 3.6.9 | 3.6.9 |
| python/python | ≥ 3.7.0, < 3.7.3 | 3.7.3 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| opensuse/leap | all versions | — |
| opensuse/leap | all versions | — |
| opensuse/leap | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_desktop | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_eus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |
| redhat/virtualization | all versions | — |
| oracle/sun_zfs_storage_appliance_kit | all versions | — |