Strix
26.1K

CVE-2019-10160

CRITICALCVSS 9.8/10EPSS 5.23%

Last modified

CVE-2019-10160 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. EPSS estimates a 5.23% chance of exploitation in the next 30 days.

Description

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
5.23%

91.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
PythonPython>= 2.7.0, < 2.7.17—
PythonPython>= 3.5.0, < 3.5.8—
PythonPython>= 3.6.0, < 3.6.9—
PythonPython>= 3.7.0, < 3.7.4—
PythonPython3.8.0Alpha4
RedhatEnterprise Linux Desktop7.0—
RedhatEnterprise Linux Eus7.6—
RedhatEnterprise Linux Server7.0—
RedhatEnterprise Linux Server Aus7.6—
RedhatEnterprise Linux Server Tus7.6—
RedhatEnterprise Linux Workstation7.0—
DebianDebian Linux8.0—
DebianDebian Linux9.0—
OpensuseLeap15.0—
OpensuseLeap15.1—
FedoraprojectFedora29—
FedoraprojectFedora30—
FedoraprojectFedora31—
CanonicalUbuntu Linux12.04—
CanonicalUbuntu Linux14.04—
CanonicalUbuntu Linux16.04—
CanonicalUbuntu Linux18.04—
CanonicalUbuntu Linux19.04—
RedhatVirtualization4.0—
NetappCloud BackupAll versions—
NetappConverged Systems Advisor AgentAll versions—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-10160?
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
How severe is CVE-2019-10160?
CVE-2019-10160 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 5.23% probability of exploitation in the next 30 days.
How do I fix CVE-2019-10160?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-10160?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST