Critical Vulnerability in Python Package: CVE-2019-17514 - Documentation Misleading Sorting Behavior
Summary
UBUNTU-CVE-2019-17514: library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm6. Fixed in 2.7.6-8ubuntu0.6+esm6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The impacted packages, including python2.7, python3.4, python3.5, python3.6, python3.7, and python3.8, are essential for running Python applications across various environments. These packages provide core functionalities for developers, enabling them to build and run applications efficiently. However, a vulnerability in the documentation of the glob module has raised concerns about its implications on sorting behavior, potentially leading to incorrect assumptions in scientific computations.
Vulnerability Detail
The vulnerability arises from misleading information in the Python documentation regarding the sorting behavior of the glob module. Prior to 2016, the documentation suggested that the sorting rules applied by the Unix shell would also apply to the glob.glob function. This misrepresentation could lead to erroneous results in applications, particularly in fields like cancer research, where reproducibility is critical. The issue is not a bug in the Python implementation itself but rather a documentation oversight that can affect security-relevant code in various applications.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can directly call the sort() function in their code to ensure that the results are sorted as expected. For example:
import glob
Get the list of files matching the pattern
files = glob.glob('*.txt')
Sort the files explicitly
sorted_files = sorted(files)
Now use sorted_files for further processing.
Conclusion
CVE-2019-17514 highlights a critical issue in the Python documentation that can mislead users regarding the sorting behavior of the glob module. It is essential for developers to update their Python packages to the patched versions to mitigate potential risks. Additionally, utilizing workarounds and tools like Vulert can help ensure that applications remain secure.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2019-17514 is a vulnerability in the Python documentation that misleads users regarding the sorting behavior of the glob module.
This vulnerability can lead to incorrect assumptions about file sorting, potentially resulting in erroneous outcomes in applications, especially in scientific research.
The affected versions include python2.7, python3.4, python3.5, python3.6, python3.7, and python3.8 across various Ubuntu distributions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
The CVSS score of CVE-2019-17514 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
