6.1

CVE-2019-16935: canonical ubuntu_linux

Modified
AliasesALPINE-CVE-2019-16935RHSA-2020:3911UBUNTU-CVE-2019-16935
Published 28-09-2019Last modified 07-10-2026

Vulnerability summary

CVE-2019-16935 is a medium (CVSS 6.1) vulnerability in canonical ubuntu_linux. EPSS estimates a 4.65% chance of exploitation in the next 30 days, higher than 91.7% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
4.65%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 27 · Related 20
DLA-2280-1DLA-2628-1MGASA-2019-0318OPENSUSE-SU-2019:2389-1OPENSUSE-SU-2019:2393-1OPENSUSE-SU-2019:2438-1

Timeline

  1. 28-09-2019
    PublishedVulnerability first disclosed.
  2. 07-10-2026
    Last modifiedVulnerability information updated.

Description

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

4.65%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.65% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • githubUnverified

    Cpython

    Maturity: poc

  • referenceUnverified

    Exploit Reference (bugs.python.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat8 products
  • python< 0:2.7.5-89.el7
  • python-debug< 0:2.7.5-89.el7
  • python-debuginfo< 0:2.7.5-89.el7
  • python-devel< 0:2.7.5-89.el7
  • python-libs< 0:2.7.5-89.el7
Ubuntu4 products
  • python2.7< 2.7.6-8ubuntu0.6+esm3 | < 2.7.12-1ubuntu0~16.04.9 | < 2.7.15-4ubuntu4~18.04.2
  • python3.4< 3.4.3-1ubuntu1~14.04.7+esm4
  • python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.9
  • python3.6< 3.6.8-1~18.04.3
Alpine3 products
  • python2< 2.7.16-r3
  • python2-tkinter< 2.7.17-r0
  • python3< 3.7.5-r0 | < 3.6.9-r1 | < 3.6.9-r2
Debian2 products
Canonical1 product
Python1 product
  • python≥ 2.7.0, < 2.7.17 | ≥ 3.0.0, < 3.5.8 | ≥ 3.6.0, < 3.6.10 | ≥ 3.7.0, < 3.7.5

6 vendors · 19 products

References

37 links
Show all 37 references