Vulnerability · NVD
CVE-2019-9636
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
Show raw CVSS vector
Tracked apps referencing this CVE
For each app: the affected range, the fixing version, and where the tracked app stands today.
NVD references 16 distinct products for this CVE — only those tracked by Scout (mobile and desktop catalog apps) are listed above. Libraries, servers and out-of-scope products do not appear here. Full list on NVD ↗
Vulnerable CPE configurations (5)
| Vendor | Product | Platform | Versions | CPE 2.3 URI |
|---|---|---|---|---|
| python |
python All platforms (wildcard)
|
All platforms (wildcard) | ≥2.7.0 <2.7.17 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python |
python All platforms (wildcard)
|
All platforms (wildcard) | ≥3.0.0 <3.4.10 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python |
python All platforms (wildcard)
|
All platforms (wildcard) | ≥3.5.0 <3.5.7 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python |
python All platforms (wildcard)
|
All platforms (wildcard) | ≥3.6.0 <3.6.9 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python |
python All platforms (wildcard)
|
All platforms (wildcard) | ≥3.7.0 <3.7.3 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |