CVE-2019-9948
criticalurllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist…
Vendor / product: Python — python
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2019-03-23 18:29
Modified: 2026-10-14 07:16
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
python / python ≥2.0 <2.7.17, ≥3.5.0 <3.5.8, ≥3.6.0 <3.6.9, ≥3.7.0 <3.7.4
opensuse / leap 15.0, 42.3
debian / debian_linux 8.0, 9.0
fedoraproject / fedora 29, 30
canonical / ubuntu_linux 12.04, 14.04, 16.04, 18.04, 19.04
redhat / enterprise_linux_desktop 7.0, 8.0
redhat / enterprise_linux_eus 8.1, 8.2, 8.4, 8.6
redhat / enterprise_linux_server 7.0, 8.0
redhat / enterprise_linux_server_eus 8.4
redhat / enterprise_linux_tus 8.2, 8.4, 8.6
redhat / enterprise_linux_workstation 7.0, 8.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://bugs.python.org/issue35907
Vendor advisory: https://bugs.python.org/issue35907
Patch / mitigation: https://github.com/python/cpython/pull/11842
Patch / mitigation: https://github.com/python/cpython/pull/11842
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html cve@mitre.org
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html cve@mitre.org
- http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.htm... cve@mitre.org
- http://www.securityfocus.com/bid/107549 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:1700 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:2030 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:3335 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:3520 cve@mitre.org
- https://bugs.python.org/issue35907 cve@mitre.org
- https://github.com/python/cpython/pull/11842 cve@mitre.org
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e8... cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://seclists.org/bugtraq/2019/Oct/29 cve@mitre.org
- https://security.gentoo.org/glsa/202003-26 cve@mitre.org
- https://security.netapp.com/advisory/ntap-20190404-0004/ cve@mitre.org
- https://usn.ubuntu.com/4127-1/ cve@mitre.org
- https://usn.ubuntu.com/4127-2/ cve@mitre.org
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html af854a3a-2127-422b-91ae-364da2661108
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html af854a3a-2127-422b-91ae-364da2661108
- http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.htm... af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗