Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2019-10160

9.8 · CRITICAL

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which…

Published Jun 7, 2019CWE-172EPSS 5.23%

Overview

CVE-2019-10160 is a critical-severity vulnerability. It was published on June 7, 2019 and has a CVSS 3.1 base score of 9.8 (CRITICAL).

This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical description

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Reflists.opensuse.org/opensuse-security-announce/2019-08/msg00042.htmlReflists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlRefaccess.redhat.com/errata/RHSA-2019:1587Refaccess.redhat.com/errata/RHSA-2019:1700Refaccess.redhat.com/errata/RHSA-2019:2437Refbugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160GitHubgithub.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09GitHubgithub.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87eGitHubgithub.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93deGitHubgithub.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468

How CyberStrike helps

Frequently asked questions

What is CVE-2019-10160?

CVE-2019-10160 is a critical-severity vulnerability. It was published on June 7, 2019 and has a CVSS 3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2019-10160?

This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2019-10160?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2019-10160?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2019-10160 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related CRITICAL CVEs from 2019

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999