Skip to content
COOEY

EXPOSURES › CVE-2019-10160

CVE-2019-10160

CRITICAL
DETAIL
SourceNVD · cve Published2019-06-07 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2019-10160 ↗

▸ RECOMMENDED ACTION  Critical severity — schedule patching of the affected products.

PLAYERS IMPLICATED
NetApp · vendorcanonical · vendordebian · vendorfedoraproject · vendoropensuse · vendorpython · vendorredhat · vendorcloud backup · productconverged systems advisor agent · productdebian linux · productenterprise linux · productenterprise linux desktop · productenterprise linux eus · productenterprise linux server · productenterprise linux server aus · productenterprise linux server tus · productenterprise linux workstation · productfedora · productleap · productpython · productubuntu linux · productvirtualization · product
DESCRIPTION

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

SENTIMENT · TRUSTED SOURCES
synthesis severe-fallout -0.60
Canonical's regression of a previously patched vulnerability (CVE-2019-9636) in Python's URL parsing, allowing credential theft via crafted URLs, was widely noted as a significant security failure, th
cooey ↗ severe-fallout -0.60
Canonical's regression of a previously patched vulnerability (CVE-2019-9636) in Python's URL parsing, allowing credential theft via crafted URLs, was widely noted as a significant security failure, th
"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL."
127.0.0.1 ↗ severe-fallout +0.00
No usable content; the source is a technical error page with no commentary on Canonical's handling or the vulnerability's impact.
AFFECTED FEDRAMP PRODUCTS · 1
PRODUCTSTATUS
Cloud Insights
NetApp
 In Process