Python up to 2.7.16/3.7.2 Unicode urllib.parse.urlsplit credentials management

Summaryinfo

A vulnerability classified as problematic was found in Python up to 2.7.16/3.7.2. This vulnerability affects unknown code in the library urllib.parse.urlsplit of the component Unicode Handler. Executing a manipulation can lead to credentials management. This vulnerability is registered as CVE-2019-9636. It is possible to launch the attack remotely. No exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability has been found in Python up to 2.7.16/3.7.2 (Programming Language Software) and classified as problematic. This vulnerability affects an unknown function in the library urllib.parse.urlsplit of the component Unicode Handler. The manipulation with an unknown input leads to a credentials management vulnerability. The CWE definition for the vulnerability is CWE-255. As an impact it is known to affect confidentiality. CVE summarizes:

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

The bug was discovered 03/08/2019. The weakness was published 03/08/2019 with Microsoft (Website). The advisory is available at securityfocus.com. This vulnerability was named CVE-2019-9636 since 03/08/2019. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 277778 (Fedora Security Update for python34 (FEDORA-2019-6baeb15da3)).

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 107400†). Similar entries are available at VDB-128349, VDB-130627, VDB-131035 and VDB-132134. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Name

• Python

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5
• 2.7.6
• 2.7.7
• 2.7.8
• 2.7.9
• 2.7.10
• 2.7.11
• 2.7.12
• 2.7.13
• 2.7.14
• 2.7.15
• 2.7.16
• 3.7.0
• 3.7.1
• 3.7.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion