What’s Vulnerable › Vulnerabilities
CVE-2019-9948
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 11.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-03-23 · updated 2026-10-14
- Weakness: CWE-22
Description
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.04
- Debian Linux: 8.0, 9.0
- Fedoraproject Fedora: 29, 30
- openSUSE Leap: 15.0, 42.3
- Python: from 2.0 before 2.7.17; from 3.5.0 before 3.5.8; from 3.6.0 before 3.6.9; from 3.7.0 before 3.7.4 — fixed in 2.7.17, 3.5.8, 3.6.9, 3.7.4
- RedHat Enterprise Linux Desktop: 7.0, 8.0
- RedHat Enterprise Linux Eus: 8.1, 8.2, 8.4, 8.6
- RedHat Enterprise Linux Server: 7.0, 8.0
- RedHat Enterprise Linux Server Eus: 8.4
- RedHat Enterprise Linux Tus: 8.2, 8.4, 8.6
- RedHat Enterprise Linux Workstation: 7.0, 8.0
How to fix
Upgrade to a fixed version: Python 2.7.17, 3.5.8, 3.6.9, 3.7.4. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html
- http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html
- http://www.securityfocus.com/bid/107549
- https://access.redhat.com/errata/RHSA-2019:1700
- https://access.redhat.com/errata/RHSA-2019:2030
- https://access.redhat.com/errata/RHSA-2019:3335
- https://access.redhat.com/errata/RHSA-2019:3520
- https://bugs.python.org/issue35907
- https://github.com/python/cpython/pull/11842
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html
Get alerted when CVE-2019-9948 or the next vulnerability affects your stack