PT-2018-3713 · Python+2 · Python+2

Published 2018-04-13 · Updated 2024-07-11 · CVE-2019-17514

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Python versions prior to 2016

Description The issue is related to incorrect calculations in the library/glob.html package of Python. It may allow a remote attacker to impact the integrity of protected information. The documentation of library/glob.html before 2016 contained potentially misleading information about sorting, which could affect security-relevant code in other domains.

Recommendations For Python versions prior to 2016, consider updating to a newer version that includes accurate documentation for library/glob.html. As a temporary workaround, call the sort() function directly, as implemented in newer versions of Willoughby nmr-data compilation-p2.py and nmr-data compilation-p3.py.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

BDU:2021-03533

CVE-2019-17514

MGASA-2020-0451

USN-4428-1

USN-4754-3

USN-6891-1

Affected Products

Linuxmint

Python

Ubuntu

References · 202

• 🔥 https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L405 · Exploit
• 🔥 https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L380 · Exploit
• 🔥 https://github.com/Einstein2150/CVE-2022-48565-POC · Exploit
• https://usn.ubuntu.com/4428-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/695338 · Security Note
• https://ubuntu.com/security/CVE-2021-4189 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647 · Security Note
• https://ubuntu.com/security/CVE-2019-16935 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42919 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-17514 · Security Note
• https://bdu.fstec.ru/vul/2024-02120 · Security Note
• https://bdu.fstec.ru/vul/2023-06655 · Security Note
• https://ubuntu.com/security/CVE-2019-9947 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-5010 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-24329 · Vendor Advisory