--- id: CVE-2019-9948 title: >- urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/… summary: >- urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/… severity: critical cvss: 9.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N' cwe: - CWE-22 vendor: python product: python affected: - 'python >= 2.0, < 2.7.17' - 'python >= 3.5.0, < 3.5.8' - 'python >= 3.6.0, < 3.6.9' - 'python >= 3.7.0, < 3.7.4' - leap = 15.0 - leap = 42.3 - debian_linux = 8.0 - debian_linux = 9.0 - fedora = 29 - fedora = 30 - ubuntu_linux = 12.04 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - ubuntu_linux = 19.04 - enterprise_linux_desktop = 7.0 - enterprise_linux_desktop = 8.0 - enterprise_linux_eus = 8.1 - enterprise_linux_eus = 8.2 - enterprise_linux_eus = 8.4 - enterprise_linux_eus = 8.6 - enterprise_linux_server = 7.0 - enterprise_linux_server = 8.0 - enterprise_linux_server_eus = 8.4 - enterprise_linux_tus = 8.2 - enterprise_linux_tus = 8.4 - enterprise_linux_tus = 8.6 - enterprise_linux_workstation = 7.0 - enterprise_linux_workstation = 8.0 patched: - python 3.7.4 published: '2019-03-23' updated: '2026-10-07' sourceUpdated: '2026-10-07T19:17:16.027' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-9948' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html' label: cve@mitre.org - url: >- http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html label: cve@mitre.org - url: 'http://www.securityfocus.com/bid/107549' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:1700' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:2030' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:3335' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:3520' label: cve@mitre.org - url: 'https://bugs.python.org/issue35907' label: cve@mitre.org - url: 'https://github.com/python/cpython/pull/11842' label: cve@mitre.org - url: >- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/ label: cve@mitre.org - url: 'https://seclists.org/bugtraq/2019/Oct/29' label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202003-26' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20190404-0004/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4127-1/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/4127-2/' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/107549' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:1700' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:2030' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:3335' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:3520' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugs.python.org/issue35907' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/python/cpython/pull/11842' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://seclists.org/bugtraq/2019/Oct/29' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202003-26' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20190404-0004/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4127-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/4127-2/' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - cve.org ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-10-07T18:26:29.669825Z' epss: 0.11844 epssPercentile: 0.95988 ingestedAt: '2026-10-07T19:44:15.635Z' --- ## Overview urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call. ## Affected - `python >= 2.0, < 2.7.17` - `python >= 3.5.0, < 3.5.8` - `python >= 3.6.0, < 3.6.9` - `python >= 3.7.0, < 3.7.4` - `leap = 15.0` - `leap = 42.3` - `debian_linux = 8.0` - `debian_linux = 9.0` - `fedora = 29` - `fedora = 30` - `ubuntu_linux = 12.04` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `ubuntu_linux = 19.04` - `enterprise_linux_desktop = 7.0` - `enterprise_linux_desktop = 8.0` - `enterprise_linux_eus = 8.1` - `enterprise_linux_eus = 8.2` - `enterprise_linux_eus = 8.4` - `enterprise_linux_eus = 8.6` - `enterprise_linux_server = 7.0` - `enterprise_linux_server = 8.0` - `enterprise_linux_server_eus = 8.4` - `enterprise_linux_tus = 8.2` - `enterprise_linux_tus = 8.4` - `enterprise_linux_tus = 8.6` - `enterprise_linux_workstation = 7.0` - `enterprise_linux_workstation = 8.0` ## Remediation Upgrade past the affected range: - `python 3.7.4`