CVE catalog

CVE-2019-10160

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which st

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
5.23% · Oct 25, 2026

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpepythonNot reportedNot reportedunknown
CpepythonNot reported3.5.8fixed
CpepythonNot reported3.6.9fixed
CpepythonNot reported3.7.4fixed
CpepythonNot reportedNot reportedunknown
CpepythonNot reportedNot reportedunknown
Cpeenterprise_linux_desktopNot reportedNot reportedunknown
Cpeenterprise_linux_eusNot reportedNot reportedunknown
Cpeenterprise_linux_serverNot reportedNot reportedunknown
Cpeenterprise_linux_server_ausNot reportedNot reportedunknown
Cpeenterprise_linux_server_tusNot reportedNot reportedunknown
Cpeenterprise_linux_workstationNot reportedNot reportedunknown
Cpedebian_linuxNot reportedNot reportedunknown
Cpedebian_linuxNot reportedNot reportedunknown
CpeleapNot reportedNot reportedunknown
CpeleapNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
Cpeubuntu_linuxNot reportedNot reportedunknown
Ubuntupython2.716.042.7.10-4ubuntu1vulnerable
Ubuntupython2.716.042.7.10-4ubuntu2vulnerable
Ubuntupython2.716.042.7.11-2vulnerable
Ubuntupython2.716.042.7.11-3vulnerable
Ubuntupython2.716.042.7.11-4vulnerable
Ubuntupython2.716.042.7.11-6vulnerable
Ubuntupython2.716.042.7.11-7vulnerable
Ubuntupython2.716.042.7.11-7ubuntu1vulnerable
Ubuntupython2.716.042.7.12-1~16.04vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.1vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.2vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.3vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.4vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.8fixed
Ubuntupython3.516.043.5.0-3vulnerable
Ubuntupython3.516.043.5.0-3ubuntu1vulnerable
Ubuntupython3.516.043.5.1~rc1-2ubuntu1vulnerable
Ubuntupython3.516.043.5.1-1vulnerable
Ubuntupython3.516.043.5.1-2vulnerable
Ubuntupython3.516.043.5.1-3vulnerable
Ubuntupython3.516.043.5.1-5vulnerable
Ubuntupython3.516.043.5.1-6ubuntu1vulnerable
Ubuntupython3.516.043.5.1-6ubuntu2vulnerable
Ubuntupython3.516.043.5.1-9ubuntu1vulnerable
Ubuntupython3.516.043.5.1-10vulnerable
Ubuntupython3.516.043.5.2-2~16.01vulnerable
Ubuntupython3.516.043.5.2-2~16.04vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.1vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.2vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.3vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.4vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.5vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.8fixed
Ubuntupython2.718.042.7.14-2ubuntu2vulnerable
Ubuntupython2.718.042.7.14-4vulnerable
Ubuntupython2.718.042.7.14-6vulnerable
Ubuntupython2.718.042.7.14-7vulnerable
Ubuntupython2.718.042.7.14-8vulnerable
Ubuntupython2.718.042.7.15~rc1-1vulnerable
Ubuntupython2.718.042.7.15~rc1-1ubuntu0.1vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04.1fixed
Ubuntupython3.618.043.6.3-1ubuntu1vulnerable
Ubuntupython3.618.043.6.4~rc1-1vulnerable
Ubuntupython3.618.043.6.4~rc1-2vulnerable
Ubuntupython3.618.043.6.4-1vulnerable
Ubuntupython3.618.043.6.4-2vulnerable
Ubuntupython3.618.043.6.4-3build1vulnerable
Ubuntupython3.618.043.6.4-4vulnerable
Ubuntupython3.618.043.6.5~rc1-1vulnerable
Ubuntupython3.618.043.6.5-3vulnerable
Ubuntupython3.618.043.6.6-1~18.04vulnerable
Ubuntupython3.618.043.6.7-1~18.04vulnerable
Ubuntupython3.618.043.6.8-1~18.04.1vulnerable
Ubuntupython3.618.043.6.8-1~18.04.2fixed
Ubuntupython2.7pro2.7.5-8ubuntu3vulnerable
Ubuntupython2.7pro2.7.5-8ubuntu4vulnerable
Ubuntupython2.7pro2.7.6-2vulnerable
Ubuntupython2.7pro2.7.6-2ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-3vulnerable
Ubuntupython2.7pro2.7.6-3ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-4vulnerable
Ubuntupython2.7pro2.7.6-4ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-5vulnerable
Ubuntupython2.7pro2.7.6-7vulnerable
Ubuntupython2.7pro2.7.6-8vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.2vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.3vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.4vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.5vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm2fixed
Ubuntupython3.4pro3.4~b1-0ubuntu3vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu4vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu6vulnerable
Ubuntupython3.4pro3.4~b1-5ubuntu2vulnerable
Ubuntupython3.4pro3.4~b2-1vulnerable
Ubuntupython3.4pro3.4~b3-1ubuntu1vulnerable
Ubuntupython3.4pro3.4~rc1-1build1vulnerable
Ubuntupython3.4pro3.4~rc2-1vulnerable
Ubuntupython3.4pro3.4~rc3-0ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.3vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.4vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.5vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.6vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm2fixed
Debianpython2.7112.7.16-3fixed
Ubuntupython2.7pro2.7.5-8ubuntu3vulnerable
Ubuntupython2.7pro2.7.5-8ubuntu4vulnerable
Ubuntupython2.7pro2.7.6-2vulnerable
Ubuntupython2.7pro2.7.6-2ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-3vulnerable
Ubuntupython2.7pro2.7.6-3ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-4vulnerable
Ubuntupython2.7pro2.7.6-4ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-5vulnerable
Ubuntupython2.7pro2.7.6-7vulnerable
Ubuntupython2.7pro2.7.6-8vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.2vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.3vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.4vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.5vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm2fixed
Ubuntupython3.4pro3.4~b1-0ubuntu3vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu4vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu6vulnerable
Ubuntupython3.4pro3.4~b1-5ubuntu2vulnerable
Ubuntupython3.4pro3.4~b2-1vulnerable
Ubuntupython3.4pro3.4~b3-1ubuntu1vulnerable
Ubuntupython3.4pro3.4~rc1-1build1vulnerable
Ubuntupython3.4pro3.4~rc2-1vulnerable
Ubuntupython3.4pro3.4~rc3-0ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.3vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.4vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.5vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.6vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm2fixed
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.4~14.04.1vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.4~14.04.1+esm1fixed
Ubuntupython2.716.042.7.10-4ubuntu1vulnerable
Ubuntupython2.716.042.7.10-4ubuntu2vulnerable
Ubuntupython2.716.042.7.11-2vulnerable
Ubuntupython2.716.042.7.11-3vulnerable
Ubuntupython2.716.042.7.11-4vulnerable
Ubuntupython2.716.042.7.11-6vulnerable
Ubuntupython2.716.042.7.11-7vulnerable
Ubuntupython2.716.042.7.11-7ubuntu1vulnerable
Ubuntupython2.716.042.7.12-1~16.04vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.1vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.2vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.3vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.4vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.8fixed
Ubuntupython3.516.043.5.0-3vulnerable
Ubuntupython3.516.043.5.0-3ubuntu1vulnerable
Ubuntupython3.516.043.5.1~rc1-2ubuntu1vulnerable
Ubuntupython3.516.043.5.1-1vulnerable
Ubuntupython3.516.043.5.1-2vulnerable
Ubuntupython3.516.043.5.1-3vulnerable
Ubuntupython3.516.043.5.1-5vulnerable
Ubuntupython3.516.043.5.1-6ubuntu1vulnerable
Ubuntupython3.516.043.5.1-6ubuntu2vulnerable
Ubuntupython3.516.043.5.1-9ubuntu1vulnerable
Ubuntupython3.516.043.5.1-10vulnerable
Ubuntupython3.516.043.5.2-2~16.01vulnerable
Ubuntupython3.516.043.5.2-2~16.04vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.1vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.2vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.3vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.4vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.5vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.8fixed
Ubuntupython2.718.042.7.14-2ubuntu2vulnerable
Ubuntupython2.718.042.7.14-4vulnerable
Ubuntupython2.718.042.7.14-6vulnerable
Ubuntupython2.718.042.7.14-7vulnerable
Ubuntupython2.718.042.7.14-8vulnerable
Ubuntupython2.718.042.7.15~rc1-1vulnerable
Ubuntupython2.718.042.7.15~rc1-1ubuntu0.1vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04.1fixed
Ubuntupython3.618.043.6.3-1ubuntu1vulnerable
Ubuntupython3.618.043.6.4~rc1-1vulnerable
Ubuntupython3.618.043.6.4~rc1-2vulnerable
Ubuntupython3.618.043.6.4-1vulnerable
Ubuntupython3.618.043.6.4-2vulnerable
Ubuntupython3.618.043.6.4-3build1vulnerable
Ubuntupython3.618.043.6.4-4vulnerable
Ubuntupython3.618.043.6.5~rc1-1vulnerable
Ubuntupython3.618.043.6.5-3vulnerable
Ubuntupython3.618.043.6.6-1~18.04vulnerable
Ubuntupython3.618.043.6.7-1~18.04vulnerable
Ubuntupython3.618.043.6.8-1~18.04.1vulnerable
Ubuntupython3.618.043.6.8-1~18.04.2fixed
Susepythonlinux enterprise module for basesystem 152.7.14-7.14.2fixed
Susepython-baselinux enterprise module for basesystem 152.7.14-7.14.2fixed
Susepythonlinux enterprise module for basesystem 15 sp12.7.14-7.14.2fixed
Susepython-baselinux enterprise module for basesystem 15 sp12.7.14-7.14.2fixed
Susepythonlinux enterprise module for desktop applications 152.7.14-7.14.2fixed
Susepythonlinux enterprise module for desktop applications 15 sp12.7.14-7.14.2fixed
Susepythonlinux enterprise module for python 2 15 sp12.7.14-7.14.2fixed
Susepython-baselinux enterprise module for python 2 15 sp12.7.14-7.14.2fixed
Opensusepythonleap 15.02.7.14-lp151.10.3.1fixed
Opensusepython-baseleap 15.02.7.14-lp151.10.3.1fixed
Opensusepython-docleap 15.02.7.14-lp151.10.3.1fixed
Opensusepythonleap 15.12.7.14-lp151.10.3.1fixed
Opensusepython-baseleap 15.12.7.14-lp151.10.3.1fixed
Opensusepython-docleap 15.12.7.14-lp151.10.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpepythoncpeNot reported3.5.8Not reportedNVD-CVE-2019-10160Not reported
CpepythoncpeNot reported3.6.9Not reportedNVD-CVE-2019-10160Not reported
CpepythoncpeNot reported3.7.4Not reportedNVD-CVE-2019-10160Not reported
Ubuntupython2.7deb16.042.7.12-1ubuntu0~16.04.8Not reportedUSN-4127-1Not reported
Ubuntupython3.5deb16.043.5.2-2ubuntu0~16.04.8Not reportedUSN-4127-1Not reported
Ubuntupython2.7deb18.042.7.15-4ubuntu4~18.04.1Not reportedUSN-4127-1Not reported
Ubuntupython3.6deb18.043.6.8-1~18.04.2Not reportedUSN-4127-1Not reported
Ubuntupython2.7debpro2.7.6-8ubuntu0.6+esm2Not reportedUSN-4127-2Not reported
Ubuntupython3.4debpro3.4.3-1ubuntu1~14.04.7+esm2Not reportedUSN-4127-2Not reported
Debianpython2.7deb112.7.16-3Not reportedDEBIAN-CVE-2019-10160Not reported
Ubuntupython2.7debpro2.7.6-8ubuntu0.6+esm2Not reportedUBUNTU-CVE-2019-10160Not reported
Ubuntupython3.4debpro3.4.3-1ubuntu1~14.04.7+esm2Not reportedUBUNTU-CVE-2019-10160Not reported
Ubuntupython3.5debpro3.5.2-2ubuntu0~16.04.4~14.04.1+esm1Not reportedUBUNTU-CVE-2019-10160Not reported
Ubuntupython2.7deb16.042.7.12-1ubuntu0~16.04.8Not reportedUBUNTU-CVE-2019-10160Not reported
Ubuntupython3.5deb16.043.5.2-2ubuntu0~16.04.8Not reportedUBUNTU-CVE-2019-10160Not reported
Ubuntupython2.7deb18.042.7.15-4ubuntu4~18.04.1Not reportedUBUNTU-CVE-2019-10160Not reported
Ubuntupython3.6deb18.043.6.8-1~18.04.2Not reportedUBUNTU-CVE-2019-10160Not reported
Susepythonrpmlinux enterprise module for basesystem 152.7.14-7.14.2Not reportedSUSE-SU-2019:2064-1Not reported
Susepython-baserpmlinux enterprise module for basesystem 152.7.14-7.14.2Not reportedSUSE-SU-2019:2064-1Not reported
Susepythonrpmlinux enterprise module for basesystem 15 sp12.7.14-7.14.2Not reportedSUSE-SU-2019:2064-1Not reported
Susepython-baserpmlinux enterprise module for basesystem 15 sp12.7.14-7.14.2Not reportedSUSE-SU-2019:2064-1Not reported
Susepythonrpmlinux enterprise module for desktop applications 152.7.14-7.14.2Not reportedSUSE-SU-2019:2064-1Not reported
Susepythonrpmlinux enterprise module for desktop applications 15 sp12.7.14-7.14.2Not reportedSUSE-SU-2019:2064-1Not reported
Susepythonrpmlinux enterprise module for python 2 15 sp12.7.14-7.14.2Not reportedSUSE-SU-2019:2064-1Not reported
Susepython-baserpmlinux enterprise module for python 2 15 sp12.7.14-7.14.2Not reportedSUSE-SU-2019:2064-1Not reported
Opensusepythonrpmleap 15.02.7.14-lp151.10.3.1Not reportedOPENSUSE-SU-2019:1906-1Not reported
Opensusepython-baserpmleap 15.02.7.14-lp151.10.3.1Not reportedOPENSUSE-SU-2019:1906-1Not reported
Opensusepython-docrpmleap 15.02.7.14-lp151.10.3.1Not reportedOPENSUSE-SU-2019:1906-1Not reported
Opensusepythonrpmleap 15.12.7.14-lp151.10.3.1Not reportedOPENSUSE-SU-2019:1906-1Not reported
Opensusepython-baserpmleap 15.12.7.14-lp151.10.3.1Not reportedOPENSUSE-SU-2019:1906-1Not reported
Opensusepython-docrpmleap 15.12.7.14-lp151.10.3.1Not reportedOPENSUSE-SU-2019:1906-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References