9.8

CVE-2019-9636: canonical ubuntu_linux Improper Handling of Alternate Encoding

Modified
AliasesALPINE-CVE-2019-9636MGASA-2019-0148SUSE-SU-2019:0961-1
Published 08-03-2019Last modified 14-10-2026

Vulnerability summary

CVE-2019-9636 is a critical (CVSS 9.8) Improper Handling of Alternate Encoding vulnerability in canonical ubuntu_linux. EPSS estimates a 7.67% chance of exploitation in the next 30 days, higher than 94.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
7.67%
0%100%
Low · -1.14 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 14
DLA-1834-1DLA-1835-1DLA-2280-1DLA-2337-1MGASA-2019-0135OPENSUSE-SU-2019:1273-1

Timeline

  1. 08-03-2019
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS metrics

8 scores · 6 sources · 3 versions

EPSS trend

Probability

7.67%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

Decrease -1.14 pp

From 8.81% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat57 products
Suse36 products
  • python3-base&distro=SUSE Enterprise Storage 4< 3.4.6-25.24.1
  • python3-base&distro=SUSE Linux Enterprise Desktop 12 SP3< 3.4.6-25.24.1
  • python3-base&distro=SUSE Linux Enterprise Desktop 12 SP4< 3.4.6-25.24.1
  • python3-base&distro=SUSE Linux Enterprise Module for Basesystem 15< 3.6.5-3.11.1
  • python3-base&distro=SUSE Linux Enterprise Module for Development Tools 15< 3.6.5-3.11.1
Ubuntu4 products
  • python2.7< 2.7.6-8ubuntu0.6+esm2 | < 2.7.12-1ubuntu0~16.04.8 | < 2.7.15-4ubuntu4~18.04.1
  • python3.4< 3.4.3-1ubuntu1~14.04.7+esm2
  • python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.8
  • python3.6< 3.6.8-1~18.04.2
Alpine3 products
  • python2< 2.7.16-r1 | < 2.7.15-r2
  • python2-tkinter< 2.7.17-r0
  • python3< 3.6.8-r0
Debian2 products
Opensuse2 products
  • leapEOL15.0 | 15.1 | 42.3
  • python3&distro=openSUSE Leap 15.0< 3.6.5-lp150.2.10.1
Canonical1 product
Fedoraproject1 product
Mageia1 product
  • python< 2.7.15-1.3.mga6
Oracle1 product
Python1 product
  • python≥ 2.7.0, < 2.7.17 | ≥ 3.0.0, < 3.4.10 | ≥ 3.5.0, < 3.5.7 | ≥ 3.6.0, < 3.6.9 | ≥ 3.7.0, < 3.7.3

11 vendors · 109 products

References

82 links
Show all 82 references