CVE-2019-9948
Published · Updated
33Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 12%
exploitation probability
12%top 4% of all CVEs
observed exploitation
nono source reports it
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
n/a · n/aReferences
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.htmlhttp://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.htmlhttps://access.redhat.com/errata/RHSA-2019:1700https://access.redhat.com/errata/RHSA-2019:2030https://access.redhat.com/errata/RHSA-2019:3335https://access.redhat.com/errata/RHSA-2019:3520https://bugs.python.org/issue35907https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlhttps://github.com/python/cpython/pull/11842https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/06/msg00022.html