CVE-2019-10160
published 2019-06-07CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and…
PriorityP359critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
5.42%
91.8th percentile
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | python2.7 | < python2.7 2.7.16-3 (bullseye) | python2.7 2.7.16-3 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| python | python | — | — |
| python | python | — | — |
| python | python | >= 2.7.0 < 2.7.17 | 2.7.17 |
| python | python | >= 3.5.0 < 3.5.8 | 3.5.8 |
| python | python | >= 3.6.0 < 3.6.9 | 3.6.9 |
| python | python | >= 3.7.0 < 3.7.4 | 3.7.4 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
osv·2024-07-11·CVSS 7.6
CVE-2015-20107 [HIGH] python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 L
GHSA
GHSA-379v-rm3f-c48g: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2
ghsa_unreviewed·2022-05-24·CVSS 9.8
CVE-2019-10160 [CRITICAL] CWE-172 GHSA-379v-rm3f-c48g: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
OSV
python2.7, python3.4 vulnerabilities
osv·2019-09-10·CVSS 7.5
CVE-2018-20406 [HIGH] python2.7, python3.4 vulnerabilities
python2.7, python3.4 vulnerabilities
USN-4127-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain pickle files. An
attacker could possibly use this issue to consume memory, leading to a
denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when
handling cookies. An attacker could possibly trick Python into sending
cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly
handled Unicode encoding during NFKC normalization. An attacker could
possibly use this issue to obtain
OSV
python2.7, python3.5, python3.6, python3.7 vulnerabilities
osv·2019-09-09·CVSS 7.5
CVE-2018-20406 [HIGH] python2.7, python3.5, python3.6, python3.7 vulnerabilities
python2.7, python3.5, python3.6, python3.7 vulnerabilities
It was discovered that Python incorrectly handled certain pickle files. An
attacker could possibly use this issue to consume memory, leading to a
denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when
handling cookies. An attacker could possibly trick Python into sending
cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly
handled Unicode encoding during NFKC normalization. An attacker could
possibly use this issue to obtain sensitive information. (CVE-2019-9636,
CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled
OSV
CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2
osv·2019-06-07·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-07-11·CVSS 7.6
CVE-2021-29921 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-14647)
Ubuntu
Python vulnerabilities
vendor_ubuntu·2019-09-10·CVSS 7.5
CVE-2018-20406 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
USN-4127-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain pickle files. An
attacker could possibly use this issue to consume memory, leading to a
denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when
handling cookies. An attacker could possibly trick Python into sending
cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly
handled Unicode encoding during NFKC normalization. An
Ubuntu
Python vulnerabilities
vendor_ubuntu·2019-09-09·CVSS 7.5
CVE-2018-20406 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain pickle files. An
attacker could possibly use this issue to consume memory, leading to a
denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when
handling cookies. An attacker could possibly trick Python into sending
cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly
handled Unicode encoding during NFKC normalization. An attacker could
possibly use this issue to obtain sensitive information. (CVE-2019-9636,
CVE-2019-10160)
Colin Read and Nicolas Edet discovered that
Red Hat
python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
vendor_redhat·2019-06-03·CVSS 9.8
CVE-2019-10160 [CRITICAL] CWE-172 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may var
Debian
CVE-2019-10160: python2.7 - A security regression of CVE-2019-9636 was discovered in python since commit d53...
vendor_debian·2019·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160: python2.7 - A security regression of CVE-2019-9636 was discovered in python since commit d53...
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
Scope: local
bullseye: resolved (fixed in 2.7.16-3)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
bugzilla·2019-07-24·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
+++ This bug was initially created as a clone of Bug #1718388 to be used as a tracking bug for 3scale errata +++
A security regression for CVE-2019-9636 was discovered in python's functions urllib.parse.urlsplit and urllib.parse.urlparse, introduced with commit d537ab0ff9767ef024f26246899728f0116b1ec3. No upstream python version is affected by this regression but the vulnerable commit may already have been included downstream as part of the original fix for CVE-2019-9636.
Affected python versions ignore the user/password part before `@` in the netloc component of a URL, thus it still allows an attacker to exploit the vulnerability as in CVE-2019-9636. Those functions do not properly
Bugzilla
CVE-2019-10160 python36: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [epel-7]
bugzilla·2019-06-10·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160 python36: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [epel-7]
CVE-2019-10160 python36: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussio
Bugzilla
CVE-2019-10160 python35: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-all]
bugzilla·2019-06-10·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160 python35: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-all]
CVE-2019-10160 python35: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NO
Bugzilla
CVE-2019-10160 python34: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-all]
bugzilla·2019-06-10·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160 python34: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-all]
CVE-2019-10160 python34: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NO
Bugzilla
CVE-2019-10160 python3: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-all]
bugzilla·2019-06-10·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160 python3: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-all]
CVE-2019-10160 python3: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOT
Bugzilla
CVE-2019-10160 python36: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-29]
bugzilla·2019-06-10·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160 python36: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-29]
CVE-2019-10160 python36: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [fedora-29]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-29.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Dis
Bugzilla
CVE-2019-10160 python34: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [epel-all]
bugzilla·2019-06-10·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160 python34: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [epel-all]
CVE-2019-10160 python34: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE:
Bugzilla
CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
bugzilla·2019-06-07·CVSS 9.8
CVE-2019-10160 [CRITICAL] CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
A security regression for CVE-2019-9636 was discovered in python's functions urllib.parse.urlsplit and urllib.parse.urlparse, introduced with commit d537ab0ff9767ef024f26246899728f0116b1ec3. No upstream python version is affected by this regression but the vulnerable commit may already have been included downstream as part of the original fix for CVE-2019-9636.
Affected python versions ignore the user/password part before `@` in the netloc component of a URL, thus it still allows an attacker to exploit the vulnerability as in CVE-2019-9636. Those functions do not properly handle URLs encoded with Punycode/Internationalizing Domain Names in Applications (IDNA), which may result in a wr
Bugzilla
CVE-2019-9636 python: Information Disclosure due to urlsplit improper NFKC normalization
bugzilla·2019-03-13·CVSS 9.8
CVE-2019-9636 [CRITICAL] CVE-2019-9636 python: Information Disclosure due to urlsplit improper NFKC normalization
CVE-2019-9636 python: Information Disclosure due to urlsplit improper NFKC normalization
A vulnerability was found in Python 2.7.x through 2.7.16 and 3.x through 3.7.2. An improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization could lead to an Information Disclosure (credentials, cookies, etc. that are cached against a given hostname) in the urllib.parse.urlsplit, urllib.parse.urlparse components. A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.
References:
https://bugs.python.org/issue36216
https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html
Uptream Patch:
https://github.com/python/cpython/pull/12201
Discus
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlhttps://access.redhat.com/errata/RHSA-2019:1587https://access.redhat.com/errata/RHSA-2019:1700https://access.redhat.com/errata/RHSA-2019:2437https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87ehttps://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93dehttps://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2020/08/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.htmlhttps://security.netapp.com/advisory/ntap-20190617-0003/https://usn.ubuntu.com/4127-1/https://usn.ubuntu.com/4127-2/http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlhttps://access.redhat.com/errata/RHSA-2019:1587https://access.redhat.com/errata/RHSA-2019:1700https://access.redhat.com/errata/RHSA-2019:2437https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87ehttps://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93dehttps://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2020/08/msg00034.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.htmlhttps://security.netapp.com/advisory/ntap-20190617-0003/https://usn.ubuntu.com/4127-1/https://usn.ubuntu.com/4127-2/
2019-06-07
Published