CVE-2019-10160: canonical ubuntu_linux Improper Encoding or Decoding of Data
Vulnerability summary
CVE-2019-10160 is a critical (CVSS 9.8) Improper Encoding or Decoding of Data vulnerability in canonical ubuntu_linux. EPSS estimates a 5.23% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities.
Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 5% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 19 · Related 15Timeline
- 07-06-2019PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.23%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
No change 0.00 pp
From 5.23% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-172Improper Encoding or Decoding of DataThe product does not properly encode or decode data, resulting in unexpected values that are not equivalent to the original data.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat15 products
- enterprise_linux_desktop7.0
- enterprise_linux_eus7.6
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.6
- enterprise_linux_server_tus7.6
Suse8 products
- python-base&distro=SUSE Linux Enterprise Module for Basesystem 15< 2.7.14-7.14.2
- python-base&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.7.14-7.14.2
- python-base&distro=SUSE Linux Enterprise Module for Python 2 15 SP1< 2.7.14-7.14.2
- python&distro=SUSE Linux Enterprise Module for Basesystem 15< 2.7.14-7.14.2
- python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.7.14-7.14.2
Opensuse7 products
- leapEOL15.0 | 15.1
- python-base&distro=openSUSE Leap 15.0< 2.7.14-lp151.10.3.1
- python-base&distro=openSUSE Leap 15.1< 2.7.14-lp151.10.3.1
- python-doc&distro=openSUSE Leap 15.0< 2.7.14-lp151.10.3.1
- python-doc&distro=openSUSE Leap 15.1< 2.7.14-lp151.10.3.1
Ubuntu4 products
- python2.7< 2.7.6-8ubuntu0.6+esm2 | < 2.7.12-1ubuntu0~16.04.8 | < 2.7.15-4ubuntu4~18.04.1
- python3.4< 3.4.3-1ubuntu1~14.04.7+esm2
- python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.8
- python3.6< 3.6.8-1~18.04.2
Debian2 products
- python2.7< 2.7.16-3
- debian_linuxEOL8.0 | 9.0
Netapp2 products
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.04
Fedoraproject1 product
- fedoraEOL29 | 30 | 31
Python1 product
- pythonEOLaffects 2.7, 3.5, 3.6, 3.7, >= v3.8.0a4 and < v3.8.0b1 | ≥ 2.7.0, < 2.7.17 | ≥ 3.5.0, < 3.5.8 | ≥ 3.6.0, < 3.6.9 | ≥ 3.7.0, < 3.7.4 | 3.8.0:alpha4 | 3.8.0:beta1
9 vendors · 41 products
References
44 links- python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.htmlX Refsource MISCPatchThird Party AdvisoryARTICLEREPORT
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87eX Refsource CONFIRMPatchThird Party Advisory
- github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93deX Refsource CONFIRMPatchThird Party Advisory
- github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09X Refsource CONFIRMPatchThird Party Advisory
- github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468X Refsource CONFIRMPatchThird Party Advisory
- access.redhat.com/errata/RHSA-2019:1587Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 44 references
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/07/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/08/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.opensuse.org/archives/…Advisory