urllib module local_file:// scheme¶
Warning
This resource is maintained for historical reference and does not contain the latest vulnerability info for Python.
The canonical database for vulnerabilities affecting Python is available on GitHub in the Open Source Vulnerability (OSV) format. This vulnerability can be viewed online at the Open Source Vulnerability Database.
urllib in Python 2.x through 2.7.16 supports the local_file: scheme,
which makes it easier for remote attackers to bypass protection mechanisms
that blacklist file: URIs, as demonstrated by triggering a
urllib.urlopen('local_file:///etc/passwd') call.
Dates:
- Disclosure date: 2019-02-06 (Python issue bpo-35907 reported)
Fixed In¶
- Python 2.7.17 (2019-10-19) fixed by commit b15bde8 (branch 2.7) (2019-05-21)
- Python 3.5.8 (2019-10-29) fixed by commit 4fe82a8 (branch 3.5) (2019-07-14)
- Python 3.6.9 (2019-07-02) fixed by commit 4f06dae (branch 3.6) (2019-05-29)
- Python 3.7.4 (2019-07-08) fixed by commit 34bab21 (branch 3.7) (2019-05-22)
- Python 3.8.0 (2019-10-14) fixed by commit 0c2b6a3 (branch 3.8) (2019-05-22)
Python issue¶
[security][CVE-2019-9948] Unnecessary URL scheme exists to allow local_file:// reading file in urllib.
- Python issue: bpo-35907
- Creation date: 2019-02-06
- Reporter: Sihoon Lee
CVE-2019-9948¶
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen(‘local_file:///etc/passwd’) call.
- CVE ID: CVE-2019-9948
- Published: 2019-03-23
- CVSS Score: 6.4
Timeline¶
Timeline using the disclosure date 2019-02-06 as reference:
- 2019-02-06: Python issue bpo-35907 reported by Sihoon Lee
- 2019-03-23 (+45 days): CVE-2019-9948 published
- 2019-05-21 (+104 days): commit b15bde8 (branch 2.7)
- 2019-05-22 (+105 days): commit 0c2b6a3 (branch 3.8)
- 2019-05-22 (+105 days): commit 34bab21 (branch 3.7)
- 2019-05-29 (+112 days): commit 4f06dae (branch 3.6)
- 2019-07-02 (+146 days): Python 3.6.9 released
- 2019-07-08 (+152 days): Python 3.7.4 released
- 2019-07-14 (+158 days): commit 4fe82a8 (branch 3.5)
- 2019-10-14: Python 3.8.0 released
- 2019-10-19 (+255 days): Python 2.7.17 released
- 2019-10-29 (+265 days): Python 3.5.8 released