---
cve: "CVE-2019-10160"
severity: "CRITICAL"
cvss: 9.8
epss: "5.2%"
vendor: "Python"
kev: false
exploited: false
published: "2019-06-07 18:29:00"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-09-08T13:17:05+02:00"
---

# CVE-2019-10160

> 9.8 CRITICAL · 🧪 PoC

## Beschreibung

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

## CVSS-Vektor

```
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- c2f86d86e6c8f5fd1ef602128b537a48f3f5c063 (Commit)
- ac39a516017c80993309f803441c8ee97c44838e (Commit)

## Referenzen

- <https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html>
- <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160>
- <https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e>
- <https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de>
- <https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09>
- <https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468>
- <https://security.netapp.com/advisory/ntap-20190617-0003/>
- <https://access.redhat.com/errata/RHSA-2019:1587>
- <https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html>
- <https://access.redhat.com/errata/RHSA-2019:1700>
- <https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/>
- <https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/>
- <https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/>
- <https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/>
- <https://access.redhat.com/errata/RHSA-2019:2437>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2019-10160) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_