Lucene search

Veracode Vulnerability DatabaseVERACODE:19903

HistoryMay 16, 2019 - 3:38 a.m.

Information Disclosure

2019-05-1603:38:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

Python is vulnerable to information disclosure vulnerability. This is because, the python’s functions urllib.parse.urlsplit and urllib.parse.urlparse do not properly handle URLs encoded with Punycode/Internationalizing Domain Names in Applications (IDNA), which may result in a wrong domain name (specifically the netloc component of URL - user@domain:port) being returned by those functions. An attacker could incorrectly parse a specially crafted URL to locate cookies or authentication data and send that information to a different host than when parsed correctly resulting a disclosure of information.

CPENameOperatorVersion
pythoneq2.7.5__76.el7
pythoneq2.7.5__69.el7_5
pythoneq2.6.6__29.el6_2.2
pythoneq2.6.6__51.el6
pythoneq2.6.6__64.el6
pythoneq2.6.6__29.el6_3.3
pythoneq2.6.6__37.el6_4
pythoneq2.6.5__3.el6
pythoneq2.6.6__52.el6
pythoneq2.6.5__3.el6_0.2

Name	Operator	Version
python	eq	2.7.5__76.el7
python	eq	2.7.5__69.el7_5
python	eq	2.6.6__29.el6_2.2
python	eq	2.6.6__51.el6
python	eq	2.6.6__64.el6
python	eq	2.6.6__29.el6_3.3
python	eq	2.6.6__37.el6_4
python	eq	2.6.5__3.el6
python	eq	2.6.6__52.el6
python	eq	2.6.5__3.el6_0.2

Rows per page:

1-10 of 2161

References

lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html

lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html

lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html

lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html

lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html

lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

www.securityfocus.com/bid/107400

access.redhat.com/errata/RHBA-2019:0763

access.redhat.com/errata/RHBA-2019:0764

access.redhat.com/errata/RHBA-2019:0959

access.redhat.com/errata/RHSA-2019:0710

access.redhat.com/errata/RHSA-2019:0765

access.redhat.com/errata/RHSA-2019:0806

access.redhat.com/errata/RHSA-2019:0902

access.redhat.com/errata/RHSA-2019:0981

access.redhat.com/errata/RHSA-2019:0997

access.redhat.com/errata/RHSA-2019:1467

access.redhat.com/errata/RHSA-2019:2980

access.redhat.com/errata/RHSA-2019:3170

access.redhat.com/security/updates/classification/#important

bugs.python.org/issue36216

github.com/python/cpython/pull/12201

lists.debian.org/debian-lts-announce/2019/06/msg00022.html

lists.debian.org/debian-lts-announce/2019/06/msg00023.html

lists.debian.org/debian-lts-announce/2020/07/msg00011.html

lists.debian.org/debian-lts-announce/2020/08/msg00034.html

lists.fedoraproject.org/archives/list/[email protected]/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/

lists.fedoraproject.org/archives/list/[email protected]/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/

lists.fedoraproject.org/archives/list/[email protected]/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/

lists.fedoraproject.org/archives/list/[email protected]/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/

lists.fedoraproject.org/archives/list/[email protected]/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/

lists.fedoraproject.org/archives/list/[email protected]/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/

lists.fedoraproject.org/archives/list/[email protected]/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/

lists.fedoraproject.org/archives/list/[email protected]/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/

lists.fedoraproject.org/archives/list/[email protected]/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/

lists.fedoraproject.org/archives/list/[email protected]/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/

lists.fedoraproject.org/archives/list/[email protected]/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/

lists.fedoraproject.org/archives/list/[email protected]/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/

lists.fedoraproject.org/archives/list/[email protected]/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/

lists.fedoraproject.org/archives/list/[email protected]/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/

lists.fedoraproject.org/archives/list/[email protected]/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/

lists.fedoraproject.org/archives/list/[email protected]/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/

lists.fedoraproject.org/archives/list/[email protected]/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/

lists.fedoraproject.org/archives/list/[email protected]/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/

lists.fedoraproject.org/archives/list/[email protected]/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/

lists.fedoraproject.org/archives/list/[email protected]/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/

python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html

security.gentoo.org/glsa/202003-26

security.netapp.com/advisory/ntap-20190517-0001/

usn.ubuntu.com/4127-1/

usn.ubuntu.com/4127-2/

www.oracle.com/security-alerts/cpujan2020.html

www.oracle.com/security-alerts/cpujul2022.html

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

Related for VERACODE:19903