Python Documentation 2/3 Sorting calculation

Summaryinfo

A vulnerability identified as critical has been detected in Python Documentation 2/3. This issue affects some unknown processing of the component Sorting. The manipulation leads to calculation. This vulnerability is documented as CVE-2019-17514. The attack can be initiated remotely. There is not any exploit available. This vulnerability is considered historic because of its background and reception. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Python Documentation 2/3 (Programming Language Software) and classified as critical. This issue affects some unknown functionality of the component Sorting. The manipulation with an unknown input leads to a calculation vulnerability. Using CWE to declare the problem leads to CWE-682. The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.

The weakness was released 10/12/2019 (Website). It is possible to read the advisory at usn.ubuntu.com. The identification of this vulnerability is CVE-2019-17514 since 10/12/2019. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/24/2025). Due to its background and reception, this vulnerability has a historic impact.

The vulnerability scanner Nessus provides a plugin with the ID 253226 (Linux Distros Unpatched Vulnerability : CVE-2019-17514), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (253226). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Name

• Python Documentation

Version

• 2
• 3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion