EXPOSURES › CVE-2019-9948
CVE-2019-9948
CRITICAL
DETAIL
SourceNVD · cve
Published2019-03-23
CVSS9.1
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2019-9948 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
canonical · vendordebian · vendorfedoraproject · vendoropensuse · vendorpython · vendorredhat · vendordebian linux · productenterprise linux desktop · productenterprise linux eus · productenterprise linux server · productenterprise linux server eus · productenterprise linux tus · productenterprise linux workstation · productfedora · productleap · productpython · productubuntu linux · product
DESCRIPTION
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
SENTIMENT · TRUSTED SOURCES
synthesis
severe-fallout
-0.60
Canonical's urllib vulnerability allowed remote attackers to bypass file URI blacklists, exposing sensitive data like /etc/passwd, reflecting a significant security oversight in Python 2.x.
NVD entry confirms the vulnerability allowed remote attackers to bypass protection mechanisms, indicating a serious flaw in Canonical's Python 2.x urllib implementation.
"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs"
No substantive coverage; the source returned a connection error and provided no information on Canonical's handling or the vulnerability's impact.
AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.