PT-2018-3713 · Python+2 · Python+2

Publicado 2018-04-13 · Atualizado 2024-07-11 · CVE-2019-17514

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Python versions prior to 2016

Description The issue is related to incorrect calculations in the library/glob.html package of Python. It may allow a remote attacker to impact the integrity of protected information. The documentation of library/glob.html before 2016 contained potentially misleading information about sorting, which could affect security-relevant code in other domains.

Recommendations For Python versions prior to 2016, consider updating to a newer version that includes accurate documentation for library/glob.html. As a temporary workaround, call the sort() function directly, as implemented in newer versions of Willoughby nmr-data compilation-p2.py and nmr-data compilation-p3.py.

Exploit

Correção

Enumeração de Fraquezas

CWE-682

Identificadores relacionados

BDU:2021-03533

CVE-2019-17514

MGASA-2020-0451

USN-4428-1

USN-4754-3

USN-6891-1

Produtos afetados

Linuxmint

Python

Ubuntu

Referências · 202

• 🔥 https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L405 · Exploit
• 🔥 https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L380 · Exploit
• 🔥 https://github.com/Einstein2150/CVE-2022-48565-POC · Exploit
• https://github.com/python/cpython/issues/98433 · Nota
• https://github.com/python/cpython/pull/16373 · Nota
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md · Nota
• https://usn.ubuntu.com/4428-1 · Aviso do Fabricante
• https://safe-surf.ru/specialists/bulletins-nkcki/695338 · Nota de Segurança
• https://ubuntu.com/security/CVE-2021-4189 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-16935 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42919 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-17514 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02120 · Nota de Segurança
• https://cxsecurity.com/cveshow/CVE-2019-17514 · Nota