Arch Linux alert ASA-201911-4 (python2)
| From: | Christian Rebischke <Chris.Rebischke@archlinux.org> | |
| To: | arch-security@archlinux.org | |
| Subject: | [ASA-201911-4] python2: information disclosure | |
| Date: | Mon, 4 Nov 2019 20:24:57 +0100 | |
| Message-ID: | <20191104192457.GB52686@motoko.nullday.de> |
Arch Linux Security Advisory ASA-201911-4 ========================================= Severity: High Date : 2019-11-03 CVE-ID : CVE-2019-9636 Package : python2 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-978 Summary ======= The package python2 before version 2.7.17-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.7.17-1. # pacman -Syu "python2>=2.7.17-1" The problem has been fixed upstream in version 2.7.17. Workaround ========== None. Description =========== Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. A specially crafted URL could be incorrectly parsed by urllib.parse.urlsplit and urllib.parse.urlparse to locate cookies or authentication data and send that information to a different host than when parsed correctly. Impact ====== A remote attacker is able to craft a malicious URL and transfer private data to a different host than expected. References ========== https://python-security.readthedocs.io/vuln/urlsplit-nfkc... https://github.com/python/cpython/commit/daad2c482c91de32... https://github.com/python/cpython/commit/f61599b050c62138... https://security.archlinux.org/CVE-2019-9636