Critical Vulnerability in Python Packages: CVE-2019-9636 - Information Disclosure Risk
Summary
UBUNTU-CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm2. Fixed in 2.7.6-8ubuntu0.6+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is utilized in various applications, from web development to data analysis. The affected packages, including python2.7, python3.4, python3.5, and others, are essential components of the Python ecosystem, providing core functionalities and libraries. This vulnerability exposes these packages to a risk of information disclosure due to improper handling of Unicode encoding during URL parsing.
Vulnerability Detail
The vulnerability, identified as CVE-2019-9636, affects Python versions 2.7.x through 2.7.16 and 3.x through 3.7.2. It arises from improper handling of Unicode encoding during NFKC normalization, which can lead to information disclosure. Specifically, a specially crafted URL could be incorrectly parsed, allowing sensitive information such as credentials and cookies to be sent to an unintended host. This poses a significant risk to applications relying on these Python versions for web interactions.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize URLs before processing them. This can help mitigate the risk of malicious URLs being parsed incorrectly. Additionally, avoid using affected versions of Python in production environments until they are updated.
Conclusion
CVE-2019-9636 is a critical vulnerability that affects several Python packages, posing a significant risk of information disclosure. It is essential to update the affected packages to their patched versions to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2019-9636 is a critical vulnerability affecting multiple Python packages that can lead to information disclosure due to improper handling of Unicode encoding during URL parsing.
The vulnerability affects Python versions 2.7.x through 2.7.16 and 3.x through 3.7.2.
The vulnerability can lead to the exposure of sensitive information such as credentials and cookies, which may be sent to unintended hosts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2019-9636 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
