CVE-2018-20852

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-07-13 · updated 2026-10-07
Weakness: CWE-20

Description

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

Affected products

Python: from 2.0 through 2.7.16; from 3.0.0 before 3.4.10; from 3.5.0 before 3.5.7; from 3.6.0 before 3.6.9; from 3.7.0 before 3.7.3 — fixed in 3.4.10, 3.5.7, 3.6.9, 3.7.3

How to fix

Upgrade to a fixed version: Python 3.4.10, 3.5.7, 3.6.9, 3.7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-20852 or the next vulnerability affects your stack