{"id":"CVE-2019-9948","title":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/…","summary":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-22"],"vendor":"python","product":"python","affected":["python >= 2.0, < 2.7.17","python >= 3.5.0, < 3.5.8","python >= 3.6.0, < 3.6.9","python >= 3.7.0, < 3.7.4","leap = 15.0","leap = 42.3","debian_linux = 8.0","debian_linux = 9.0","fedora = 29","fedora = 30","ubuntu_linux = 12.04","ubuntu_linux = 14.04","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ubuntu_linux = 19.04","enterprise_linux_desktop = 7.0","enterprise_linux_desktop = 8.0","enterprise_linux_eus = 8.1","enterprise_linux_eus = 8.2","enterprise_linux_eus = 8.4","enterprise_linux_eus = 8.6","enterprise_linux_server = 7.0","enterprise_linux_server = 8.0","enterprise_linux_server_eus = 8.4","enterprise_linux_tus = 8.2","enterprise_linux_tus = 8.4","enterprise_linux_tus = 8.6","enterprise_linux_workstation = 7.0","enterprise_linux_workstation = 8.0"],"patched":["python 3.7.4"],"published":"2019-03-23","updated":"2026-10-07","sourceUpdated":"2026-10-07T19:17:16.027","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","label":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","label":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/107549","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:1700","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2030","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3335","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3520","label":"cve@mitre.org"},{"url":"https://bugs.python.org/issue35907","label":"cve@mitre.org"},{"url":"https://github.com/python/cpython/pull/11842","label":"cve@mitre.org"},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","label":"cve@mitre.org"},{"url":"https://seclists.org/bugtraq/2019/Oct/29","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202003-26","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20190404-0004/","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4127-1/","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4127-2/","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/107549","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:1700","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2030","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3335","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3520","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.python.org/issue35907","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/python/cpython/pull/11842","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://seclists.org/bugtraq/2019/Oct/29","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202003-26","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190404-0004/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4127-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4127-2/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-07T18:26:29.669825Z"},"epss":0.11844,"epssPercentile":0.95988,"ingestedAt":"2026-10-07T19:44:15.635Z","slug":"CVE-2019-9948","body":"## Overview\n\nurllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.\n\n## Affected\n\n- `python >= 2.0, < 2.7.17`\n- `python >= 3.5.0, < 3.5.8`\n- `python >= 3.6.0, < 3.6.9`\n- `python >= 3.7.0, < 3.7.4`\n- `leap = 15.0`\n- `leap = 42.3`\n- `debian_linux = 8.0`\n- `debian_linux = 9.0`\n- `fedora = 29`\n- `fedora = 30`\n- `ubuntu_linux = 12.04`\n- `ubuntu_linux = 14.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ubuntu_linux = 19.04`\n- `enterprise_linux_desktop = 7.0`\n- `enterprise_linux_desktop = 8.0`\n- `enterprise_linux_eus = 8.1`\n- `enterprise_linux_eus = 8.2`\n- `enterprise_linux_eus = 8.4`\n- `enterprise_linux_eus = 8.6`\n- `enterprise_linux_server = 7.0`\n- `enterprise_linux_server = 8.0`\n- `enterprise_linux_server_eus = 8.4`\n- `enterprise_linux_tus = 8.2`\n- `enterprise_linux_tus = 8.4`\n- `enterprise_linux_tus = 8.6`\n- `enterprise_linux_workstation = 7.0`\n- `enterprise_linux_workstation = 8.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `python 3.7.4`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":50.1,"likelihood":2.4,"exploitation":0,"ransomware":0},"changes":[]}