Lucene search

Veracode Vulnerability DatabaseVERACODE:20588

HistoryJun 24, 2019 - 12:20 a.m.

Information Disclosure

2019-06-2400:20:59

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

python is vulnerable to information disclosure. A regression of CVE-2019-9636 due to a functional fix to allow port numbers in netloc allows an attacker to locate confidential information such as cookies and authentication data and forward the information to a different host. * python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc (CVE-2019-10160) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CPENameOperatorVersion
pythoneq2.7.5__76.el7
pythoneq2.7.5__69.el7_5
pythoneq2.7.5__77.el7_6
python27-pythoneq2.7.13__3.el7
python27-pythoneq2.7.8__18.el6
python27-pythoneq2.7.16__4.el6
python27-pythoneq2.7.16__4.el7
python27-pythoneq2.7.13__4.el6
python27-pythoneq2.7.5__7.el6
python27-pythoneq2.7.13__3.el6

Name	Operator	Version
python	eq	2.7.5__76.el7
python	eq	2.7.5__69.el7_5
python	eq	2.7.5__77.el7_6
python27-python	eq	2.7.13__3.el7
python27-python	eq	2.7.8__18.el6
python27-python	eq	2.7.16__4.el6
python27-python	eq	2.7.16__4.el7
python27-python	eq	2.7.13__4.el6
python27-python	eq	2.7.5__7.el6
python27-python	eq	2.7.13__3.el6

Rows per page:

1-10 of 2741

References

lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html

lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

access.redhat.com/errata/RHSA-2019:1587

access.redhat.com/errata/RHSA-2019:1700

access.redhat.com/errata/RHSA-2019:2437

access.redhat.com/security/cve/CVE-2019-10160

access.redhat.com/security/updates/classification/#important

bugzilla.redhat.com/show_bug.cgi?id=1718388

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160

github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09

github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e

github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de

github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468

lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E

lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E

lists.debian.org/debian-lts-announce/2019/06/msg00022.html

lists.debian.org/debian-lts-announce/2020/07/msg00011.html

lists.debian.org/debian-lts-announce/2020/08/msg00034.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/

lists.fedoraproject.org/archives/list/[email protected]/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/

lists.fedoraproject.org/archives/list/[email protected]/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/

lists.fedoraproject.org/archives/list/[email protected]/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/

lists.fedoraproject.org/archives/list/[email protected]/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/

lists.fedoraproject.org/archives/list/[email protected]/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/

lists.fedoraproject.org/archives/list/[email protected]/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/

lists.fedoraproject.org/archives/list/[email protected]/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/

lists.fedoraproject.org/archives/list/[email protected]/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/

lists.fedoraproject.org/archives/list/[email protected]/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/

lists.fedoraproject.org/archives/list/[email protected]/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/

python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html

security.netapp.com/advisory/ntap-20190617-0003/

usn.ubuntu.com/4127-1/

usn.ubuntu.com/4127-2/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

Related for VERACODE:20588