CVE-2019-9948

high-risk

Published 2019-03-23

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

Do I need to act?

0.96% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.1/10 Critical

NETWORK / LOW complexity

Affected Products (20)

Python

Leap

Debian Linux

Fedora

Ubuntu Linux

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Affected Vendors

Debian Redhat Python Canonical Fedoraproject Opensuse

References (44)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html

Third Party Advisory http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-U...

Third Party Advisory http://www.securityfocus.com/bid/107549

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:1700

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2030

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3335

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3520

Exploit https://bugs.python.org/issue35907

Patch https://github.com/python/cpython/pull/11842

https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab...

Mailing List https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html

Mailing List https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html

Mailing List https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html

Mailing List https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Mailing List https://seclists.org/bugtraq/2019/Oct/29

Third Party Advisory https://security.gentoo.org/glsa/202003-26

Third Party Advisory https://security.netapp.com/advisory/ntap-20190404-0004/

and 24 more references

/ 100

high-risk

Severity 31/34 · Critical

Exploitability 3/34 · Minimal

Exposure 21/34 · High