Critical Vulnerability in Python Packages: CVE-2019-10160
Summary
UBUNTU-CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attack... Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm2. Fixed in 2.7.6-8ubuntu0.6+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is utilized in various applications, from web development to data analysis. The affected packages, including python2.7, python3.4, python3.5, and others, are integral to many Ubuntu systems, providing essential functionalities for running Python applications. This vulnerability exposes these packages to potential security risks, particularly in how they handle user-supplied URLs.
Vulnerability Detail
A security regression was discovered in Python that affects versions 2.7, 3.5, 3.6, 3.7, and from v3.8.0a4 through v3.8.0b1. The vulnerability allows attackers to exploit the user and password parts of a URL, enabling them to craft malicious URLs that could lead to unauthorized access to sensitive information such as cookies and authentication data. This could result in data leakage or unauthorized actions within applications that improperly parse these URLs.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize user-supplied URLs before processing them. This can help mitigate the risk of exploitation until the packages can be updated.
Conclusion
CVE-2019-10160 represents a significant security risk for applications using affected Python packages. It is essential to apply the necessary updates to mitigate this vulnerability and ensure the security of your applications. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain a secure software environment.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2019-10160 is a critical vulnerability in Python packages that allows attackers to exploit user-supplied URLs, potentially leading to unauthorized access to sensitive information.
The vulnerability affects Python versions 2.7, 3.5, 3.6, 3.7, and specific pre-release versions of 3.8.
Exploitation of this vulnerability can lead to data leakage, unauthorized access to cookies and authentication data, and potentially compromise the security of applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for CVE-2019-10160 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
