CVE-2019-9636CWE-173

CVE-2019-9636

Critical · published March 9, 2019

CVSS v3.1
9.8
EPSS
8%
Percentile
94.6
In the wild
Unconfirmed
What it is

⚠️ A sneaky Unicode mishap in Python could let attackers read your cookies like an open book! 📖 Think of urllib as a delivery system for URLs, but sometimes it misreads the address—like a post office sending your mail to the wrong house. This little error can lead sensitive info straight to a stranger! If an attacker crafts a specific URL, they could redirect your sensitive data, such as credentials and cookies, to an unauthorized host—imagine handing your house keys to a stranger just because they had a clever story! The potential for information disclosure is absolutely daunting, especially for any applications relying on these Python versions.

Put simply

Think of urllib as a delivery system for URLs, but sometimes it misreads the address—like a post office sending your mail to the wrong house. This little error can lead sensitive info straight to a stranger! This vulnerability arises from improper handling of Unicode encoding during NFKC normalization in Python's urllib.parse.urlsplit and urlparse functions, allowing attackers to manipulate URL parsing to extract cached data.

What to do

If an attacker crafts a specific URL, they could redirect your sensitive data, such as credentials and cookies, to an unauthorized host—imagine handing your house keys to a stranger just because they had a clever story! The potential for information disclosure is absolutely daunting, especially for any applications relying on these Python versions. To protect yourself, ensure you upgrade Python to at least version 2.7.17 or 3.7.3. Review your code and any services using urllib to enforce secure URL handling practices to mitigate this potential risk. You've got this! With a quick update, your security hero status is activated! 🦸‍♂️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07673 · 94.6th percentile
Weakness
CWE-173 · Improper Handling of Alternate Encoding
Published
2019-03-09T02:29Z
Affected products (40)
ProductVersionsFixed in
python/python≥ 2.7.0, < 2.7.172.7.17
python/python≥ 3.0.0, < 3.4.103.4.10
python/python≥ 3.5.0, < 3.5.73.5.7
python/python≥ 3.6.0, < 3.6.93.6.9
python/python≥ 3.7.0, < 3.7.33.7.3
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
opensuse/leapall versions—
opensuse/leapall versions—
opensuse/leapall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
redhat/openshift_container_platformall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linux_desktopall versions—
redhat/enterprise_linux_eusall versions—
redhat/enterprise_linux_eusall versions—
redhat/enterprise_linux_eusall versions—
redhat/enterprise_linux_eusall versions—
redhat/enterprise_linux_eusall versions—
redhat/enterprise_linux_serverall versions—
redhat/enterprise_linux_server_ausall versions—
redhat/enterprise_linux_server_ausall versions—
redhat/enterprise_linux_server_ausall versions—
redhat/enterprise_linux_server_eusall versions—
redhat/enterprise_linux_server_tusall versions—
redhat/enterprise_linux_server_tusall versions—
redhat/enterprise_linux_server_tusall versions—
redhat/enterprise_linux_server_tusall versions—
redhat/enterprise_linux_workstationall versions—
redhat/virtualizationall versions—
oracle/sun_zfs_storage_appliance_kitall versions—
References (105)
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html · [email protected]http://www.securityfocus.com/bid/107400 · [email protected]https://access.redhat.com/errata/RHBA-2019:0763 · [email protected]https://access.redhat.com/errata/RHBA-2019:0764 · [email protected]https://access.redhat.com/errata/RHBA-2019:0959 · [email protected]https://access.redhat.com/errata/RHSA-2019:0710 · [email protected]https://access.redhat.com/errata/RHSA-2019:0765 · [email protected]https://access.redhat.com/errata/RHSA-2019:0806 · [email protected]https://access.redhat.com/errata/RHSA-2019:0902 · [email protected]https://access.redhat.com/errata/RHSA-2019:0981 · [email protected]https://access.redhat.com/errata/RHSA-2019:0997 · [email protected]https://access.redhat.com/errata/RHSA-2019:1467 · [email protected]https://access.redhat.com/errata/RHSA-2019:2980 · [email protected]https://access.redhat.com/errata/RHSA-2019:3170 · [email protected]https://bugs.python.org/issue36216 · [email protected]https://github.com/python/cpython/pull/12201 · [email protected]https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html · [email protected]https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html · [email protected]https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html · [email protected]https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/ · [email protected]https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html · [email protected]https://security.gentoo.org/glsa/202003-26 · [email protected]https://security.netapp.com/advisory/ntap-20190517-0001/ · [email protected]https://usn.ubuntu.com/4127-1/ · [email protected]https://usn.ubuntu.com/4127-2/ · [email protected]https://www.oracle.com/security-alerts/cpujan2020.html · [email protected]https://www.oracle.com/security-alerts/cpujul2022.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/107400 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHBA-2019:0763 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHBA-2019:0764 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHBA-2019:0959 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:0710 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:0765 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:0806 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:0902 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:0981 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:0997 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:1467 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:2980 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:3170 · af854a3a-2127-422b-91ae-364da2661108https://bugs.python.org/issue36216 · af854a3a-2127-422b-91ae-364da2661108https://github.com/python/cpython/pull/12201 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/ · af854a3a-2127-422b-91ae-364da2661108https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202003-26 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20190517-0001/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4127-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4127-2/ · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2022.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 08 MAR 21:00Z
    Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization
    cvelistv5