CVE-2019-10160
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jun 7, 2019
- Updated
- Oct 14, 2026
- Reserved
- Mar 27, 2019
Description
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.8 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
pythonPython |
|
References
- https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160
- https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e
- https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de
- https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09
- https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468
- https://security.netapp.com/advisory/ntap-20190617-0003/
- RHSA-2019:1587vendor-advisory
- [debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security updatemailing-list
- RHSA-2019:1700vendor-advisory
- FEDORA-2019-7723d4774avendor-advisory
- FEDORA-2019-7df59302e0vendor-advisory
- FEDORA-2019-9bfb4a3e4bvendor-advisory
- FEDORA-2019-60a1defcd1vendor-advisory
- RHSA-2019:2437vendor-advisory
- openSUSE-SU-2019:1906vendor-advisory
- USN-4127-2vendor-advisory
- USN-4127-1vendor-advisory
- FEDORA-2019-50772cf122vendor-advisory
- FEDORA-2019-5dc275c9f2vendor-advisory
- FEDORA-2019-2b1f72899avendor-advisory
- FEDORA-2019-b06ec6159bvendor-advisory
- FEDORA-2019-d202cda4f8vendor-advisory
- FEDORA-2019-57462fa10dvendor-advisory
- openSUSE-SU-2020:0086vendor-advisory
- [debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security updatemailing-list
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 imagemailing-list
- [debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security updatemailing-list
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.