Critical Information Disclosure Vulnerability in Python2 and Python3 Packages
Summary
ALPINE-CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. Affects python2 versions < 2.7.16-r1. Fixed in 2.7.16-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The Python2 and Python3 packages in Alpine Linux provide essential functionalities for running Python applications. However, these packages have been found vulnerable to a specific issue that affects their handling of Unicode encoding, potentially leading to serious security risks.
Vulnerability Detail
The vulnerability arises from improper handling of Unicode encoding during NFKC normalization in the urllib.parse.urlsplit and urllib.parse.urlparse functions. This flaw allows attackers to craft specially formatted URLs that could lead to the incorrect parsing of cookies or authentication data. As a result, sensitive information may be disclosed to unauthorized hosts, posing a significant risk to user credentials and other confidential data.
How To Fix
Minimum fixed version
2.7.16-r1
This is the first release that contains the fix.
sudo apk add --upgrade python2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using URLs that may be crafted to exploit this vulnerability. Ensure that any URLs processed by your application are validated and sanitized to prevent potential attacks.
Conclusion
The vulnerability in Python2 and Python3 packages poses a significant risk due to improper handling of Unicode encoding, leading to potential information disclosure. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for python2 →
FAQ
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
Python versions 2.7.x through 2.7.16 and 3.x through 3.7.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to information disclosure, including sensitive data such as credentials and cookies, which could be exploited by attackers.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python2.
