CVE-2019-10160
criticalA security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and…
Vendor / product: Python — python
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2019-06-07 18:29
Modified: 2026-10-14 07:16
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
python / python ≥2.7.0 <2.7.17, ≥3.5.0 <3.5.8, ≥3.6.0 <3.6.9, ≥3.7.0 <3.7.4, 3.8.0
redhat / enterprise_linux_desktop 7.0
redhat / enterprise_linux_eus 7.6
redhat / enterprise_linux_server 7.0
redhat / enterprise_linux_server_aus 7.6
redhat / enterprise_linux_server_tus 7.6
redhat / enterprise_linux_workstation 7.0
debian / debian_linux 8.0, 9.0
opensuse / leap 15.0, 15.1
fedoraproject / fedora 29, 30, 31
canonical / ubuntu_linux 12.04, 14.04, 16.04, 18.04, 19.04
redhat / virtualization 4.0
netapp / cloud_backup all versions
netapp / converged_systems_advisor_agent all versions
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160
Patch / mitigation: https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09
Patch / mitigation: https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e
Patch / mitigation: https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de
Patch / mitigation: https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468
Patch / mitigation: https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html
Patch / mitigation: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160
Patch / mitigation: https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html secalert@redhat.com
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2019:1587 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2019:1700 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2019:2437 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160 secalert@redhat.com
- https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09 secalert@redhat.com
- https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e secalert@redhat.com
- https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de secalert@redhat.com
- https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468 secalert@redhat.com
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e8... secalert@redhat.com
- https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html secalert@redhat.com
- https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html secalert@redhat.com
- https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... secalert@redhat.com
- https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html secalert@redhat.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗