Homepage
About Snyk

Encoding Error Affecting platform-python-devel package, versions <0:3.6.8-2.el8_0

Severity

 Recommended
high

Based on Red Hat Enterprise Linux security rating

    Threat Intelligence

    EPSS
    1.35% (87th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RHEL8-PLATFORMPYTHONDEVEL-3402731
  • published 26 Jul 2021
  • disclosed 6 Mar 2019
Report a new vulnerability Found a mistake?

Introduced: 6 Mar 2019

CVE-2019-9636 Open this link in a new tab
CWE-172 Open this link in a new tab

How to fix?

Upgrade RHEL:8 platform-python-devel to version 0:3.6.8-2.el8_0 or higher.
This issue was patched in RHSA-2019:0997.

NVD Description

Note: Versions mentioned in the description apply only to the upstream platform-python-devel package and not the platform-python-devel package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

References

CVSS Scores

version 3.1
Expand this section

NVD

9.8 critical
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High