Catalogo CVE

CVE-2019-16935

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Li

[Catalogo CVE]

Gravità
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
4.65% · Oct 22, 2026

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjythonsid2.7.3+repack1-1fixed
Debianjythonforky2.7.3+repack1-1fixed
Debianjythontrixie2.7.3+repack1-1fixed
Debianjythonbookworm2.7.3+repack1-1fixed
CpepythonNot reported2.7.17fixed
CpepythonNot reported3.5.8fixed
CpepythonNot reported3.6.10fixed
CpepythonNot reported3.7.5fixed
Cpedebian_linuxNot reportedNot reportedunknown
Cpeubuntu_linuxNot reportedNot reportedunknown
Cpeubuntu_linuxNot reportedNot reportedunknown
Cpeubuntu_linuxNot reportedNot reportedunknown
Cpeubuntu_linuxNot reportedNot reportedunknown
Cpeubuntu_linuxNot reportedNot reportedunknown
Ubuntupython2.7pro2.7.5-8ubuntu3vulnerable
Ubuntupython2.7pro2.7.5-8ubuntu4vulnerable
Ubuntupython2.7pro2.7.6-2vulnerable
Ubuntupython2.7pro2.7.6-2ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-3vulnerable
Ubuntupython2.7pro2.7.6-3ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-4vulnerable
Ubuntupython2.7pro2.7.6-4ubuntu1vulnerable
Ubuntupython2.7pro2.7.6-5vulnerable
Ubuntupython2.7pro2.7.6-7vulnerable
Ubuntupython2.7pro2.7.6-8vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.2vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.3vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.4vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.5vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm2vulnerable
Ubuntupython2.7pro2.7.6-8ubuntu0.6+esm3fixed
Ubuntupython3.4pro3.4~b1-0ubuntu3vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu4vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu6vulnerable
Ubuntupython3.4pro3.4~b1-5ubuntu2vulnerable
Ubuntupython3.4pro3.4~b2-1vulnerable
Ubuntupython3.4pro3.4~b3-1ubuntu1vulnerable
Ubuntupython3.4pro3.4~rc1-1build1vulnerable
Ubuntupython3.4pro3.4~rc2-1vulnerable
Ubuntupython3.4pro3.4~rc3-0ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.3vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.4vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.5vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.6vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm2vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm4fixed
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.4~14.04.1vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.4~14.04.1+esm1fixed
Ubuntupython2.716.042.7.10-4ubuntu1vulnerable
Ubuntupython2.716.042.7.10-4ubuntu2vulnerable
Ubuntupython2.716.042.7.11-2vulnerable
Ubuntupython2.716.042.7.11-3vulnerable
Ubuntupython2.716.042.7.11-4vulnerable
Ubuntupython2.716.042.7.11-6vulnerable
Ubuntupython2.716.042.7.11-7vulnerable
Ubuntupython2.716.042.7.11-7ubuntu1vulnerable
Ubuntupython2.716.042.7.12-1~16.04vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.1vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.2vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.3vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.4vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.8vulnerable
Ubuntupython2.716.042.7.12-1ubuntu0~16.04.9fixed
Ubuntupython3.516.043.5.0-3vulnerable
Ubuntupython3.516.043.5.0-3ubuntu1vulnerable
Ubuntupython3.516.043.5.1~rc1-2ubuntu1vulnerable
Ubuntupython3.516.043.5.1-1vulnerable
Ubuntupython3.516.043.5.1-2vulnerable
Ubuntupython3.516.043.5.1-3vulnerable
Ubuntupython3.516.043.5.1-5vulnerable
Ubuntupython3.516.043.5.1-6ubuntu1vulnerable
Ubuntupython3.516.043.5.1-6ubuntu2vulnerable
Ubuntupython3.516.043.5.1-9ubuntu1vulnerable
Ubuntupython3.516.043.5.1-10vulnerable
Ubuntupython3.516.043.5.2-2~16.01vulnerable
Ubuntupython3.516.043.5.2-2~16.04vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.1vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.2vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.3vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.4vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.5vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.8vulnerable
Ubuntupython3.516.043.5.2-2ubuntu0~16.04.9fixed
Ubuntupython2.718.042.7.14-2ubuntu2vulnerable
Ubuntupython2.718.042.7.14-4vulnerable
Ubuntupython2.718.042.7.14-6vulnerable
Ubuntupython2.718.042.7.14-7vulnerable
Ubuntupython2.718.042.7.14-8vulnerable
Ubuntupython2.718.042.7.15~rc1-1vulnerable
Ubuntupython2.718.042.7.15~rc1-1ubuntu0.1vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04.1vulnerable
Ubuntupython2.718.042.7.15-4ubuntu4~18.04.2fixed
Ubuntupython3.618.043.6.3-1ubuntu1vulnerable
Ubuntupython3.618.043.6.4~rc1-1vulnerable
Ubuntupython3.618.043.6.4~rc1-2vulnerable
Ubuntupython3.618.043.6.4-1vulnerable
Ubuntupython3.618.043.6.4-2vulnerable
Ubuntupython3.618.043.6.4-3build1vulnerable
Ubuntupython3.618.043.6.4-4vulnerable
Ubuntupython3.618.043.6.5~rc1-1vulnerable
Ubuntupython3.618.043.6.5-3vulnerable
Ubuntupython3.618.043.6.6-1~18.04vulnerable
Ubuntupython3.618.043.6.7-1~18.04vulnerable
Ubuntupython3.618.043.6.8-1~18.04.1vulnerable
Ubuntupython3.618.043.6.8-1~18.04.2vulnerable
Ubuntupython3.618.043.6.8-1~18.04.3fixed
Alpinepython23.112.7.16-r3fixed
Alpinepython23.122.7.16-r3fixed
Alpinepython33.103.7.5-r0fixed
Alpinepython33.113.7.5-r0fixed
Alpinepython33.123.7.5-r0fixed
Alpinepython33.133.7.5-r0fixed
Alpinepython33.143.7.5-r0fixed
Alpinepython33.153.7.5-r0fixed
Alpinepython33.163.7.5-r0fixed
Alpinepython33.173.7.5-r0fixed
Alpinepython33.183.7.5-r0fixed
Alpinepython33.193.7.5-r0fixed
Alpinepython33.203.7.5-r0fixed
Alpinepython33.213.7.5-r0fixed
Alpinepython33.223.7.5-r0fixed
Alpinepython33.233.7.5-r0fixed
Alpinepython33.243.7.5-r0fixed
Alpinepython33.73.6.9-r1fixed
Alpinepython33.83.6.9-r1fixed
Alpinepython33.93.6.9-r2fixed
Opensusepython3leap 15.23.6.12-lp152.4.14.1fixed
Opensusepython3-coreleap 15.23.6.12-lp152.4.14.1fixed
Opensusepython3-documentationleap 15.23.6.12-lp152.4.14.1fixed
Opensusepython3leap 15.13.6.12-lp151.6.32.1fixed
Opensusepython3-coreleap 15.13.6.12-lp151.6.32.1fixed
Opensusepython3-documentationleap 15.13.6.12-lp151.6.32.1fixed
Susepython3linux enterprise module for basesystem 15 sp13.6.12-3.67.2fixed
Susepython3-corelinux enterprise module for basesystem 15 sp13.6.12-3.67.2fixed
Susepython3linux enterprise module for basesystem 15 sp23.6.12-3.67.2fixed
Susepython3-corelinux enterprise module for basesystem 15 sp23.6.12-3.67.2fixed
Susepython3-corelinux enterprise module for development tools 15 sp13.6.12-3.67.2fixed
Susepython3-corelinux enterprise module for development tools 15 sp23.6.12-3.67.2fixed
Susepython3linux enterprise high performance computing 15-espos3.6.12-3.67.2fixed
Susepython3-corelinux enterprise high performance computing 15-espos3.6.12-3.67.2fixed
Susepython3linux enterprise high performance computing 15-ltss3.6.12-3.67.2fixed
Susepython3-corelinux enterprise high performance computing 15-ltss3.6.12-3.67.2fixed
Susepython3linux enterprise server 15-ltss3.6.12-3.67.2fixed
Susepython3-corelinux enterprise server 15-ltss3.6.12-3.67.2fixed
Susepython3linux enterprise server for sap applications 153.6.12-3.67.2fixed
Susepython3-corelinux enterprise server for sap applications 153.6.12-3.67.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjythonsourcesid2.7.2+repack1-5not yet assignedNot reported[1027149]
Debianjythonsourceforky2.7.2+repack1-5not yet assignedNot reported[1027149]
Debianjythonsourcetrixie2.7.2+repack1-5not yet assignedNot reported[1027149]
Debianjythonsourcebookworm2.7.2+repack1-5not yet assignedNot reported[1027149]
CpepythoncpeNot reported2.7.17Not reportedNVD-CVE-2019-16935Not reported
CpepythoncpeNot reported3.5.8Not reportedNVD-CVE-2019-16935Not reported
CpepythoncpeNot reported3.6.10Not reportedNVD-CVE-2019-16935Not reported
CpepythoncpeNot reported3.7.5Not reportedNVD-CVE-2019-16935Not reported
Ubuntupython2.7debpro2.7.6-8ubuntu0.6+esm3Not reportedUBUNTU-CVE-2019-16935Not reported
Ubuntupython3.4debpro3.4.3-1ubuntu1~14.04.7+esm4Not reportedUBUNTU-CVE-2019-16935Not reported
Ubuntupython3.5debpro3.5.2-2ubuntu0~16.04.4~14.04.1+esm1Not reportedUBUNTU-CVE-2019-16935Not reported
Ubuntupython2.7deb16.042.7.12-1ubuntu0~16.04.9Not reportedUBUNTU-CVE-2019-16935Not reported
Ubuntupython3.5deb16.043.5.2-2ubuntu0~16.04.9Not reportedUBUNTU-CVE-2019-16935Not reported
Ubuntupython2.7deb18.042.7.15-4ubuntu4~18.04.2Not reportedUBUNTU-CVE-2019-16935Not reported
Ubuntupython3.6deb18.043.6.8-1~18.04.3Not reportedUBUNTU-CVE-2019-16935Not reported
Alpinepython2apk3.112.7.16-r3Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython2apk3.122.7.16-r3Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.103.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.113.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.123.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.133.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.143.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.153.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.163.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.173.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.183.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.193.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.203.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.213.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.223.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.233.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.243.7.5-r0Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.73.6.9-r1Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.83.6.9-r1Not reportedALPINE-CVE-2019-16935Not reported
Alpinepython3apk3.93.6.9-r2Not reportedALPINE-CVE-2019-16935Not reported
Opensusepython3rpmleap 15.23.6.12-lp152.4.14.1Not reportedOPENSUSE-SU-2020:2332-1Not reported
Opensusepython3-corerpmleap 15.23.6.12-lp152.4.14.1Not reportedOPENSUSE-SU-2020:2332-1Not reported
Opensusepython3-documentationrpmleap 15.23.6.12-lp152.4.14.1Not reportedOPENSUSE-SU-2020:2332-1Not reported
Opensusepython3rpmleap 15.13.6.12-lp151.6.32.1Not reportedOPENSUSE-SU-2020:2333-1Not reported
Opensusepython3-corerpmleap 15.13.6.12-lp151.6.32.1Not reportedOPENSUSE-SU-2020:2333-1Not reported
Opensusepython3-documentationrpmleap 15.13.6.12-lp151.6.32.1Not reportedOPENSUSE-SU-2020:2333-1Not reported
Susepython3rpmlinux enterprise module for basesystem 15 sp13.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3-corerpmlinux enterprise module for basesystem 15 sp13.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3rpmlinux enterprise module for basesystem 15 sp23.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3-corerpmlinux enterprise module for basesystem 15 sp23.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3-corerpmlinux enterprise module for development tools 15 sp13.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3-corerpmlinux enterprise module for development tools 15 sp23.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3rpmlinux enterprise high performance computing 15-espos3.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3-corerpmlinux enterprise high performance computing 15-espos3.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3rpmlinux enterprise high performance computing 15-ltss3.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3-corerpmlinux enterprise high performance computing 15-ltss3.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3rpmlinux enterprise server 15-ltss3.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3-corerpmlinux enterprise server 15-ltss3.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3rpmlinux enterprise server for sap applications 153.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported
Susepython3-corerpmlinux enterprise server for sap applications 153.6.12-3.67.2Not reportedSUSE-SU-2020:3930-1Not reported

[Debian bug #1027149]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [jython]Corretta
    Dettagli (2)
    • 2.7.3+repack1-1 · all · bookworm

      Corretta · Corretta: 2.7.2+repack1-5

      nvd · jython · debian · bookworm; nvd · jython · debian · 12

    • 2.7.3+repack1-1 · all · bookworm

      Corretta · Corretta: 2.7.2+repack1-5

      nvd · jython · debian · bookworm; nvd · jython · debian · 12

  • [jython-doc]Corretta

    Pacchetto sorgente: [jython]

    Dettagli (2)
    • 2.7.3+repack1-1 · all · bookworm

      Corretta · Corretta: 2.7.2+repack1-5

      nvd · jython · debian · bookworm; nvd · jython · debian · 12

    • 2.7.3+repack1-1 · all · bookworm

      Corretta · Corretta: 2.7.2+repack1-5

      nvd · jython · debian · bookworm; nvd · jython · debian · 12

[Debian 13 (Trixie)]

  • [jython]Corretta
    Dettagli (2)
    • 2.7.3+repack1-1 · all · trixie

      Corretta · Corretta: 2.7.2+repack1-5

      nvd · jython · debian · 13

    • 2.7.3+repack1-1 · all · trixie

      Corretta · Corretta: 2.7.2+repack1-5

      nvd · jython · debian · 13

  • [jython-doc]Corretta

    Pacchetto sorgente: [jython]

    Dettagli (2)
    • 2.7.3+repack1-1 · all · trixie

      Corretta · Corretta: 2.7.2+repack1-5

      nvd · jython · debian · 13

    • 2.7.3+repack1-1 · all · trixie

      Corretta · Corretta: 2.7.2+repack1-5

      nvd · jython · debian · 13

Osservato:

Riferimenti