Cross-site scripting in Python - CVE-2019-16935

Vulnerability identifier: #VU21440

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2019-16935

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when processing the server_title field in the XML-RPC server (Lib/DocXMLRPCServer.py) in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Python
Amazon Linux AMI
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Ubuntu
Opensuse
Fedora
Red Hat OpenShift Serverless
Quay
OpenShift Data Foundation (formerly OpenShift Container Storage)
python (Red Hat package)
python2-tkinter (Alpine package)
python3 (Red Hat package)
python3.7 (Ubuntu package)
python3.8 (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.9-minimal (Ubuntu package)
python3.11-minimal (Ubuntu package)
python3.6 (Ubuntu package)
python3.11 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python3.7-minimal (Ubuntu package)
python3.5 (Ubuntu package)
python3.5-minimal (Ubuntu package)
python2-docs
python2
python35
python36
python3.10 (Ubuntu package)
python3.10-minimal (Ubuntu package)
python3.12 (Ubuntu package)
python3.12-minimal (Ubuntu package)
Ansible Automation Platform
IBM Robotic Process Automation
Red Hat OpenShift Container Platform

Install update from vendor's website.

Python - addressed in versions 2.7.17, 3.6.10, 3.7.5
Red Hat OpenShift Serverless - addressed in versions 1.10.2, 1.11.0
python (Red Hat package) - update to 2.7.5-89.el7
python2-tkinter (Alpine package) - update to 2.7.17-r0
Quay - update to 3.3.3
python3 (Red Hat package) - addressed in versions 3.6.8-17.el7, 3.6.8-31.el8
python3.7 (Ubuntu package) - update to Ubuntu Pro
python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.6 (Ubuntu package) - update to Ubuntu Pro
python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.6-minimal (Ubuntu package) - update to Ubuntu Pro
python3.7-minimal (Ubuntu package) - update to Ubuntu Pro
python3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.5-minimal (Ubuntu package) - update to Ubuntu Pro
Ansible Automation Platform - addressed in versions 1.0, 1.1
python2-docs - addressed in versions 2.7.17-1.fc29, 2.7.17-1.fc30, 2.7.17-1.fc31
python2 - addressed in versions 2.7.17-1.fc29, 2.7.17-1.fc30, 2.7.17-1.fc31
python35 - addressed in versions 3.5.8-2.fc29, 3.5.8-2.fc30, 3.5.8-2.fc31
python36 - addressed in versions 3.6.10-1.fc30, 3.6.10-1.fc31
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
Red Hat OpenShift Container Platform - update to 4.3.40
IBM Robotic Process Automation - update to 21.0.5

• https://bugs.python.org/issue38243
• https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897
• https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213
• https://github.com/python/cpython/pull/16373

• Cross-site scripting in XML-RPC server in Python
• OpenSUSE Linux update for python3
• OpenSUSE Linux update for python3
• OpenSUSE Linux update for python
• OpenSUSE Linux update for python
• Amazon Linux AMI update for python27, python35, python36
• Cross-site scripting in python2-tkinter (Alpine package)
• Red Hat Enterprise Linux 7 update for python3
• Red Hat Enterprise Linux 7 update for python
• Red Hat Enterprise Linux 8 update for python3
• Multiple vulnerabilities in Red Hat Openshift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat Quay
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Ubuntu update for python3.10
• Multiple vulnerabilities in Ansible Automation Platform 1.0 packages
• Multiple vulnerabilities in Ansible Automation Platform 1.1 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Fedora 31 update for python2, python2-docs
• Fedora 30 update for python2, python2-docs
• Fedora 29 update for python2, python2-docs
• Fedora 30 update for python35
• Fedora 29 update for python35
• Fedora 31 update for python35
• Fedora 30 update for python36
• Fedora 31 update for python36