Vulnerability identifier: #VU20071

Vulnerability risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-10160

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Python
Universal components / Libraries / Scripting languages

Vendor: Python.org

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user and password parts of a URL. This issue exists due to incorrect patch for previous issue described in SB2019030811 (CVE-2019-9636). A remote attacker can gain access to sensitive information.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Python: 3.7.3, 2.7 - 2.7.2150, 3.5 - 3.5.7, 3.3.5 - 3.3.6, 3.6 - 3.6.8, 2.3.6

---

External links
http://access.redhat.com/errata/RHSA-2019:1587
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160
http://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09
http://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e
http://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de
http://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468
http://lists.debian.org/debian-lts-announce/2019/06/msg00022.html
http://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html
http://security.netapp.com/advisory/ntap-20190617-0003/

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.