This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-20852 →

UBUNTU-CVE-2018-20852

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricke...

Original description

The description as published by the source.

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:14.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.6+esm2"}]}]

Ubuntu:Pro:14.04:LTS python3.4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1ubuntu1~14.04.7+esm2"}]}]

Ubuntu:Pro:14.04:LTS python3.5

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"}]}]

Ubuntu:16.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.8"}]}]

Ubuntu:16.04:LTS python3.5

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.8"}]}]

Ubuntu:18.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.15-4ubuntu4~18.04.1"}]}]

Ubuntu:18.04:LTS python3.6

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-1~18.04.2"}]}]

References

advisory ubuntu.com
advisory ubuntu.com
advisory ubuntu.com
report ubuntu.com
report python-security.readthedocs.io
report cve.org