IM
IronMonkey Threat Research

CVE-2019-9636 CRITICAL

Published: 2019-03-08 | Last Modified: 2026-10-07 | Status: Modified

Description

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Additional Descriptions (1)

Python, en las versiones 2.7.x hasta la 2.7.16 y en las 3.x hasta la 3.7.2, se ve afectado por lo siguiente: Gestión incorrecta de codificación Unicode (con un netloc incorrecto) durante la normalización NFKC. Su impacto provoca: la divulgación de información (credenciales, cookies, etc, que estén cacheados contra un determinado nombre de host). Los componentes son los siguientes: urllib.parse.urlsplit y urllib.parse.urlparse. El vector de ataque es el siguiente: una URL especialmente manipulada puede analizarse sintácticamente de manera incorrecta para localizar cookies o datos de autenticación y enviar dicha información a un host distinto con respecto a cuando se analiza de manera correcta. Esta corregido en las versiones: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-173

Affected Products

Vendor Product Version Update Type
python python * <built-in method update of dict object at 0x7fd341be9200> Application
python python * <built-in method update of dict object at 0x7fd341be8080> Application
python python * <built-in method update of dict object at 0x7fd341541e80> Application
python python * <built-in method update of dict object at 0x7fd36ada01c0> Application
python python * <built-in method update of dict object at 0x7fd341be8a40> Application
fedoraproject fedora 28 <built-in method update of dict object at 0x7fd341bea080> Operating System
fedoraproject fedora 29 <built-in method update of dict object at 0x7fd341541f40> Operating System
fedoraproject fedora 30 <built-in method update of dict object at 0x7fd38477ce00> Operating System
fedoraproject fedora 31 <built-in method update of dict object at 0x7fd341be9c40> Operating System
opensuse leap 15.0 <built-in method update of dict object at 0x7fd341bea200> Operating System
opensuse leap 15.1 <built-in method update of dict object at 0x7fd341beac40> Operating System
opensuse leap 42.3 <built-in method update of dict object at 0x7fd36ada2e80> Operating System
debian debian_linux 8.0 <built-in method update of dict object at 0x7fd341beb3c0> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd36b4e9d40> Operating System
canonical ubuntu_linux 12.04 <built-in method update of dict object at 0x7fd3686c0400> Operating System
canonical ubuntu_linux 14.04 <built-in method update of dict object at 0x7fd36b4e8380> Operating System
canonical ubuntu_linux 16.04 <built-in method update of dict object at 0x7fd36a7eeec0> Operating System
canonical ubuntu_linux 18.04 <built-in method update of dict object at 0x7fd341be8680> Operating System
canonical ubuntu_linux 19.04 <built-in method update of dict object at 0x7fd341542c00> Operating System
redhat openshift_container_platform 3.11 <built-in method update of dict object at 0x7fd370398c00> Application
redhat enterprise_linux 7.5 <built-in method update of dict object at 0x7fd38418e6c0> Operating System
redhat enterprise_linux 8.0 <built-in method update of dict object at 0x7fd341543d80> Operating System
redhat enterprise_linux_desktop 6.0 <built-in method update of dict object at 0x7fd341beb980> Operating System
redhat enterprise_linux_eus 7.5 <built-in method update of dict object at 0x7fd36b4eb400> Operating System
redhat enterprise_linux_eus 8.1 <built-in method update of dict object at 0x7fd341be9b40> Operating System
redhat enterprise_linux_eus 8.2 <built-in method update of dict object at 0x7fd368ea7cc0> Operating System
redhat enterprise_linux_eus 8.4 <built-in method update of dict object at 0x7fd36b4ebd40> Operating System
redhat enterprise_linux_eus 8.6 <built-in method update of dict object at 0x7fd341bead80> Operating System
redhat enterprise_linux_server 6.0 <built-in method update of dict object at 0x7fd36b4ebdc0> Operating System
redhat enterprise_linux_server_aus 7.4 <built-in method update of dict object at 0x7fd340891d00> Operating System
redhat enterprise_linux_server_aus 8.2 <built-in method update of dict object at 0x7fd39c4a4e40> Operating System
redhat enterprise_linux_server_aus 8.4 <built-in method update of dict object at 0x7fd34bce2f40> Operating System
redhat enterprise_linux_server_eus 5.6 <built-in method update of dict object at 0x7fd31b236900> Operating System
redhat enterprise_linux_server_tus 7.4 <built-in method update of dict object at 0x7fd34bce1440> Operating System
redhat enterprise_linux_server_tus 8.2 <built-in method update of dict object at 0x7fd38673bc80> Operating System
redhat enterprise_linux_server_tus 8.4 <built-in method update of dict object at 0x7fd3854bdc80> Operating System
redhat enterprise_linux_server_tus 8.6 <built-in method update of dict object at 0x7fd31b234880> Operating System
redhat enterprise_linux_workstation 6.0 <built-in method update of dict object at 0x7fd31b237880> Operating System
redhat virtualization 4.0 <built-in method update of dict object at 0x7fd36ada00c0> Application
oracle sun_zfs_storage_appliance_kit 8.8.6 <built-in method update of dict object at 0x7fd31b237300> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_eus:5.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit:8.8.6:*:*:*:*:*:*:*

References