5.3

CVE-2018-20852: python Improper Input Validation

Modified
AliasesSUSE-SU-2019:2114-1UBUNTU-CVE-2018-20852DEBIAN-CVE-2018-20852
Published 13-07-2019Last modified 07-10-2026

Vulnerability summary

CVE-2018-20852 is a medium (CVSS 5.3) Improper Input Validation vulnerability in python. EPSS estimates a 3.67% chance of exploitation in the next 30 days, higher than 89.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.0 (NVD)
EPSS score
3.67%
0%100%
Low · -0.21 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 23 · Related 15
DLA-2280-1DLA-2337-1OPENSUSE-SU-2020:0086-1OPENSUSE-SU-2024:11202-1OPENSUSE-SU-2024:11284-1RHSA-2019:3725

Timeline

  1. 13-07-2019
    PublishedVulnerability first disclosed.
  2. 07-10-2026
    Last modifiedVulnerability information updated.

Description

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

CVSS metrics

7 scores · 4 sources · 3 versions

EPSS trend

Probability

3.67%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

Decrease -0.21 pp

From 3.88% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugs.python.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Suse8 products
  • python-base&distro=SUSE Linux Enterprise Module for Basesystem 15< 2.7.14-7.17.1
  • python-base&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.7.14-7.17.1
  • python-base&distro=SUSE Linux Enterprise Module for Python 2 15 SP1< 2.7.14-7.17.1
  • python&distro=SUSE Linux Enterprise Module for Basesystem 15< 2.7.14-7.17.1
  • python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.7.14-7.17.1
Opensuse4 products
  • python-base&distro=openSUSE Leap 15.1< 2.7.14-lp151.10.7.1
  • python-doc&distro=openSUSE Leap 15.1< 2.7.14-lp151.10.7.1
  • python&distro=openSUSE Leap 15.0< 2.7.14-lp150.6.17.1
  • python&distro=openSUSE Leap 15.1< 2.7.14-lp151.10.7.1
Ubuntu4 products
  • python2.7< 2.7.6-8ubuntu0.6+esm2 | < 2.7.12-1ubuntu0~16.04.8 | < 2.7.15-4ubuntu4~18.04.1
  • python3.4< 3.4.3-1ubuntu1~14.04.7+esm2
  • python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.8
  • python3.6< 3.6.8-1~18.04.2
Debian2 products
  • python2.7< 2.7.16-3 | < 2.7.9-2+deb8u4
  • python3.4< 3.4.2-1+deb8u6
Python1 product
  • python≥ 2.0, ≤ 2.7.16 | ≥ 3.0.0, < 3.4.10 | ≥ 3.5.0, < 3.5.7 | ≥ 3.6.0, < 3.6.9 | ≥ 3.7.0, < 3.7.3

5 vendors · 19 products

References

29 links
Show all 29 references