CVE-2019-10160: Canonical Ubuntu Linux

Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days.

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 29 only; version 30 only; version 31 only
• Netapp Cloud Backup: affected versions not specified
• Netapp Converged Systems Advisor Agent: affected versions not specified
• Opensuse Leap: version 15.0 only; version 15.1 only
• Python Python: from 2.7.0, before 2.7.17 (fixed in 2.7.17); from 3.5.0, before 3.5.8 (fixed in 3.5.8); from 3.6.0, before 3.6.9 (fixed in 3.6.9); from 3.7.0, before 3.7.4 (fixed in 3.7.4); version 3.8.0 only
• Red Hat Enterprise Linux Desktop: version 7.0 only
• Red Hat Enterprise Linux Eus: version 7.6 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.6 only
• Red Hat Enterprise Linux Server Tus: version 7.6 only
• Red Hat Enterprise Linux Workstation: version 7.0 only
• Red Hat Virtualization: version 4.0 only

Published 2019-06-07. Last modified 2026-10-07.