CVE-2019-9948

🗓️ 23 Mar 2019 17:07:08Reported by mitreType

vulnrichment🔗 github.com👁 5 Views

urllib in Python 2.x supports local_file: scheme leading to protection bypass.

Reporter	Title	Published	Views	Family All 229
FreeBSD	python 3.6 -- multiple vulnerabilities	13 Mar 201900:00	–	freebsd
FreeBSD	python 3.7 -- multiple vulnerabilities	13 Mar 201900:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Python as used by IBM QRadar Network Packet Capture is vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers (CVE-2019-9947, CVE-2019-9948)	20 Dec 201908:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities were fixed in IBM Security Access Manager Appliance	28 Jan 202015:11	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in python affects IBM Watson Studio Local	20 Dec 201921:38	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Cloud Foundry - Python (CVE-2019-9947, CVE-2019-9948)	2 Jan 202014:17	–	ibm
IBM Security Bulletins	Security Bulletin: [All] Python (Publicly disclosed vulnerability)	16 Sep 202016:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Python affect IBM Operations Analytics Predictive Insights (CVE-2019-9948, CVE-2019-9947)	28 Feb 202016:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by Python vulnerabilities	5 Oct 202020:53	–	ibm
IBM Security Bulletins	Security Bulletin: Resilient is vulnerable to using Python component with known vulnerabilities in RHEL 7	8 Apr 202018:30	–	ibm

Source	Link
bugs	www.bugs.python.org/issue35907
usn	www.usn.ubuntu.com/4127-1/
lists	www.lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
access	www.access.redhat.com/errata/RHSA-2019:3335
usn	www.usn.ubuntu.com/4127-2/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/
github	www.github.com/python/cpython/pull/11842
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/
lists	www.lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html
access	www.access.redhat.com/errata/RHSA-2019:2030

22 Aug 2020 16:06Current

CVSS 3.19.1

EPSS0.11844

SSVC

Python 2.x urllib local_file: scheme protection bypass