Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2019-10160

Published: 7 June 2019

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

Priority

Medium

Cvss 3 Severity Score

9.8

Score breakdown

Status

Package Release Status
python2.7
Launchpad, Ubuntu, Debian
bionic
Released (2.7.15-4ubuntu4~18.04.1)
cosmic Ignored
(end of life)
disco
Released (2.7.16-2ubuntu0.1)
eoan Not vulnerable
(2.7.16-3)
focal Not vulnerable
(2.7.16-3)
groovy Not vulnerable
(2.7.16-3)
hirsute Not vulnerable
(2.7.16-3)
impish Not vulnerable
(2.7.16-3)
jammy Not vulnerable
(2.7.16-3)
kinetic Not vulnerable
(2.7.16-3)
lunar Does not exist

mantic Does not exist

noble Does not exist

trusty
Released (2.7.6-8ubuntu0.6+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
upstream Needs triage

xenial
Released (2.7.12-1ubuntu0~16.04.8)
Patches:
upstream: https://github.com/python/cpython/commit/98a4dcefbbc3bce5ab07e7c0830a183157250259
upstream: https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de
upstream: https://github.com/python/cpython/commit/2b578479b96aa3deeeb8bac313a02b5cf3cb1aff




python3.4
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty
Released (3.4.3-1ubuntu1~14.04.7+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
upstream Needs triage

xenial Does not exist

python3.5
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Needed

upstream Needs triage

xenial
Released (3.5.2-2ubuntu0~16.04.8)
python3.6
Launchpad, Ubuntu, Debian
bionic
Released (3.6.8-1~18.04.2)
cosmic Ignored
(end of life)
disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

Patches:



upstream: https://github.com/python/cpython/commit/e5f9f4adb95233c66578e6f7ea176687af2f78ca
upstream: https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468


python3.7
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(was needed)
cosmic Ignored
(end of life)
disco
Released (3.7.3-2ubuntu0.1)
eoan Not vulnerable
(3.7.4~rc2-1)
focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

kinetic Does not exist

lunar Does not exist

mantic Does not exist

noble Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

Patches:





upstream: https://github.com/python/cpython/commit/4d723e76e1ad17e9e7d5e828e59bb47e76f2174b
upstream: https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09

Severity score breakdown

Parameter Value
Base score 9.8
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H