#VU20071 Input validation error in Python - CVE-2019-10160

Vulnerability identifier: #VU20071

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-10160

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Python
Universal components / Libraries / Scripting languages

Vendor: Python.org

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user and password parts of a URL. This issue exists due to incorrect patch for previous issue described in SB2019030811 (CVE-2019-9636). A remote attacker can gain access to sensitive information.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Python: 2.3.6, 2.7 - 2.7.2150, 3.3.5 - 3.3.6, 3.5 - 3.5.7, 3.6 - 3.6.8, 3.7.3

---

External links
https://access.redhat.com/errata/RHSA-2019:1587
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160
https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09
https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e
https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de
https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468
https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html
https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html
https://security.netapp.com/advisory/ntap-20190617-0003/

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.