CVE-2019-16935: Canonical Ubuntu Linux

Medium severity, CVSS 6.1. EPSS: 4.7% chance of exploitation in the next 30 days.

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 19.04 only
• Debian Debian Linux: version 9.0 only
• Python Python: from 2.7.0, before 2.7.17 (fixed in 2.7.17); from 3.0.0, before 3.5.8 (fixed in 3.5.8); from 3.6.0, before 3.6.10 (fixed in 3.6.10); from 3.7.0, before 3.7.5 (fixed in 3.7.5)

Published 2019-09-28. Last modified 2026-10-07.