A vulnerability has been discovered in Python, an interactive high-level object-oriented language, that is relevant for cookie handling. By using a malicious server an attacker might steal cookies that are meant for other domains

For Debian 8 'Jessie', this problem has been fixed in version 3.4.2-1+deb8u6.

We recommend that you upgrade your python3.4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the python3 package has been released.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1132 advisory.

  - http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before     3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3. (CVE-2018-20852)

  - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x     through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An     application that uses the email module and implements some kind of checks on the From/To headers of a     message could be tricked into accepting an email address that should be denied. An attack may be the same     as in CVE-2019-11340; however, this CVE applies to Python more generally. (CVE-2019-16056)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

* python: Cookie domain check returns incorrect results * python:
email.utils.parseaddr wrongly parses email addresses

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1764 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Cookie domain check returns incorrect results (CVE-2018-20852)

    * python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python27 installed on the remote host is prior to 2.7.18-1.137. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1375 advisory.

    http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before     3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.(CVE-2018-20852)

    An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP     header. This is similar to theCVE-2019-9740query string issue and theCVE-2019-9947path string issue. (This     is not exploitable when glibc hasCVE-2016-10739fixed.) A CRLF injection flaw was discovered in python in     the way URLs are handled when doing an HTTP/HTTPS connection (e.g. through urlopen() or HTTPConnection).
    An attacker who can control the url parameter passed to urlopen method in the urllib/urllib2 modules can     inject CRLF sequences and HTTP headers by abusing the host part of the URL. (CVE-2019-18348)(Additional     CVE details added after release.)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were discovered in Python, an interactive high-level object-oriented language.

CVE-2018-20406

Modules/_pickle.c has an integer overflow via a large LONG_BINPUT value that is mishandled during a 'resize to twice the size' attempt.
This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data.

CVE-2018-20852

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com).
When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker.

CVE-2019-5010

An exploitable denial of service vulnerability exists in the X509 certificate parser. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

CVE-2019-9636

Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname).
The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.

CVE-2019-9740

An issue was discovered in urllib2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.

CVE-2019-9947

An issue was discovered in urllib2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.

CVE-2019-9948

urllib supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file:
URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVE-2019-10160

A security regression was discovered in python, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

CVE-2019-16056

The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

CVE-2019-16935

The documentation XML-RPC server has XSS via the server_title field.
This occurs in Lib/xmlrpc/server.py. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

CVE-2019-18348

An issue was discovered in urllib2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue

CVE-2020-8492

Python allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

CVE-2020-14422

Lib/ipaddress.py improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created.

For Debian 9 stretch, these problems have been fixed in version 3.5.3-1+deb9u2.

We recommend that you upgrade your python3.5 packages.

For the detailed security status of python3.5 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/python3.5

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-969:01 advisory.

    * python-urllib3: Cross-host redirect does not remove Authorization header allow     for credential exposure (CVE-2018-20060)
    * python: Cookie domain check returns incorrect results (CVE-2018-20852)
    * python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading     to possible attack on internal service (CVE-2019-11236)
    * python-urllib3: Certification mishandle when error should be thrown     (CVE-2019-11324)
    * python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)
    * python-requests: Redirect from HTTPS to HTTP does not remove Authorization     header (CVE-2018-18074)     Modularity name: python27     Stream name: 2.7

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1605 advisory.

  - python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

  - python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure     (CVE-2018-20060)

  - python: Cookie domain check returns incorrect results (CVE-2018-20852)

  - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on     internal service (CVE-2019-11236)

  - python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

  - python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

  - python: XSS vulnerability in the documentation XML-RPC server in server_title field (CVE-2019-16935)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_1605 advisory.

    * python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure     (CVE-2018-20060)

    * python: Cookie domain check returns incorrect results (CVE-2018-20852)

    * python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on     internal service (CVE-2019-11236)

    * python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

    * python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

    * python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
127925	Debian DLA-1889-1 : python3.4 security update	Nessus	Debian Local Security Checks	2019/8/20	2024/5/2	medium
128172	Photon OS 1.0: Python3 PHSA-2019-1.0-0246	Nessus	PhotonOS Local Security Checks	2019/8/26	2024/5/1	medium
128721	Photon OS 2.0: Python3 PHSA-2019-2.0-0171	Nessus	PhotonOS Local Security Checks	2019/9/12	2024/7/23	medium
135344	CentOS 7 : python3 (RHSA-2020:1132)	Nessus	CentOS Local Security Checks	2020/4/10	2024/10/9	high
135831	Scientific Linux Security Update : python on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	2020/4/21	2024/3/15	high
136049	RHEL 8 : python3 (RHSA-2020:1764)	Nessus	Red Hat Local Security Checks	2020/4/28	2024/11/7	high
137098	Amazon Linux AMI : python27 (ALAS-2020-1375)	Nessus	Amazon Linux Local Security Checks	2020/6/4	2024/12/17	medium
138529	Debian DLA-2280-1 : python3.5 security update	Nessus	Debian Local Security Checks	2020/7/16	2024/3/1	critical
293883	MiracleLinux 8 : python27:2.7 (AXSA:2020-969:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
145889	CentOS 8 : python27:2.7 (CESA-2020:1605)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	critical
358057	Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / babel / etc Multiple Vulnerabilities (crlsa-2020_1605)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical

检测

插件搜索

medium

medium

medium

high

high

high

medium

critical

critical

critical

critical