Description
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected products
- Canonical / Ubuntu Linux19.04 – 19.04
- Canonical / Ubuntu Linux16.04 – 16.04
- Canonical / Ubuntu Linux18.04 – 18.04
- Canonical / Ubuntu Linux12.04 – 12.04
- Canonical / Ubuntu Linux14.04 – 14.04
- Debian / debian_linux8.0 – 8.0
- Debian / debian_linux9.0 – 9.0
- fedoraproject / fedora30 – 30
- fedoraproject / fedora29 – 29
- openSUSE / Leap15.0 – 15.0
- openSUSE / Leap42.3 – 42.3
- Python / python2.0 – 2.7.17
- RedHat / enterprise_linux_desktop8.0 – 8.0
- RedHat / enterprise_linux_desktop7.0 – 7.0
- RedHat / enterprise_linux_eus8.1 – 8.1
- RedHat / enterprise_linux_eus8.2 – 8.2
- RedHat / enterprise_linux_eus8.4 – 8.4
- RedHat / enterprise_linux_eus8.6 – 8.6
- RedHat / enterprise_linux_server7.0 – 7.0
- RedHat / enterprise_linux_server8.0 – 8.0
- RedHat / enterprise_linux_server_eus8.4 – 8.4
- RedHat / enterprise_linux_tus8.2 – 8.2
- RedHat / enterprise_linux_tus8.4 – 8.4
- RedHat / enterprise_linux_tus8.6 – 8.6
- RedHat / enterprise_linux_workstation7.0 – 7.0
- RedHat / enterprise_linux_workstation8.0 – 8.0
References
- MISChttps://bugs.python.org/issue35907
- PATCHhttps://github.com/python/cpython/pull/11842
- MISChttp://www.securityfocus.com/bid/107549
- MISChttps://security.netapp.com/advisory/ntap-20190404-0004/
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html
- MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2019/06/msg00022.html
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:1700
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2019/07/msg00011.html
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:2030
- VENDOR_ADVISORYhttps://usn.ubuntu.com/4127-2/
- VENDOR_ADVISORYhttps://usn.ubuntu.com/4127-1/
- MAILING_LISThttps://seclists.org/bugtraq/2019/Oct/29
- EXPLOIThttp://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3335
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3520
- MISChttps://security.gentoo.org/glsa/202003-26
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
- MAILING_LISThttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/08/msg00034.html
Updated 10m ago · 8 sources