CVE-2019-9948

CWE-22 — Path TraversalCWE-74920 documents8 sources
Severity
9.1CRITICAL
EPSS
1.0%
top 23.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Python PythonCanonical Ubuntu LinuxDebian Debian Linux+8 more
Timeline
PublishedMar 23
Latest updateJul 11

Description

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages6 packages

▶NVDpython/python2.0 — 2.7.17+3
▶Debianpython2.7< 2.7.16-2
▶NVDopensuse/leap15.0, 42.3+1

Also affects: Debian Linux 8.0, 9.0, Fedora 29, 30, Ubuntu Linux 12.04, 14.04, 16.04, 18.04, 19.04, Enterprise Linux 8.1, 8.2, 8.4, 8.6

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-24p8-x4mp-cq86: urllib in Python 2↗2022-05-24
▶
CVEList
CVE-2019-9948: urllib in Python 2↗2019-03-23
▶
OSV
CVE-2019-9948: urllib in Python 2↗2019-03-23
▶

📋Vendor Advisories

5
Ubuntu
Python vulnerabilities↗2024-07-11
▶
Ubuntu
Python vulnerabilities↗2019-09-10
▶
Ubuntu
Python vulnerabilities↗2019-09-09
▶
Red Hat
python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms↗2019-03-23
▶
Debian
CVE-2019-9948: python2.7 - urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes...↗2019
▶

💬Community

11
Bugzilla
CVE-2019-9948 python3: python: undocumented local_file protocol allows remote attackers to bypass protection mechanisms [fedora-all]↗2019-04-17
▶
Bugzilla
CVE-2019-9948 python3: python: undocumented local_file protocol allows remote attackers to bypass protection mechanisms [fedora-all]↗2019-04-17
▶
Bugzilla
CVE-2019-9947 CVE-2019-9948 python37: various flaws [fedora-28]↗2019-04-11
▶
Bugzilla
CVE-2019-9947 CVE-2019-9948 python34: various flaws [epel-all]↗2019-04-11
▶
Bugzilla
CVE-2019-9947 CVE-2019-9948 python36: various flaws [fedora-29]↗2019-04-11
▶