This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2019-9948 →
UBUNTU-CVE-2019-9948
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that b...
Original description
The description as published by the source.
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:14.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.6+esm2"}]}]
Ubuntu:Pro:14.04:LTS
python3.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1ubuntu1~14.04.7+esm2"}]}]
Ubuntu:Pro:14.04:LTS
python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"}]}]
Ubuntu:16.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.8"}]}]
Ubuntu:16.04:LTS
python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.8"}]}]
Ubuntu:18.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.15-4ubuntu4~18.04.1"}]}]
Ubuntu:18.04:LTS
python3.6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.8-1~18.04.2"}]}]
References
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report github.com
- report cve.org