CVE-2019-9948: canonical ubuntu_linux

Modified

AliasesALPINE-CVE-2019-9948MGASA-2019-0165UBUNTU-CVE-2019-9948+2 more

Published 23-03-2019Last modified 14-10-2026

Vulnerability summary

CVE-2019-9948 is a critical (CVSS 9.1) vulnerability in canonical ubuntu_linux. EPSS estimates a 11.84% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

9.1/10

010

Critical · v3.1 (CVE.org)

EPSS score

11.84%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 21 · Related 9

Timeline

23-03-2019
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVSS metrics

7 scores · 5 sources · 3 versions

v3.19.1v3.09.1v2.06.4

EPSS trend

Probability

11.84%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 11.84% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.python.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat6 products

enterprise_linux_desktop7.0 | 8.0
enterprise_linux_eus8.1 | 8.2 | 8.4 | 8.6
enterprise_linux_server7.0 | 8.0
enterprise_linux_server_eus8.4
enterprise_linux_tus8.2 | 8.4 | 8.6

Show all 6

Ubuntu4 products

python2.7< 2.7.6-8ubuntu0.6+esm2 | < 2.7.12-1ubuntu0~16.04.8 | < 2.7.15-4ubuntu4~18.04.1
python3.4< 3.4.3-1ubuntu1~14.04.7+esm2
python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.8
python3.6< 3.6.8-1~18.04.2

Debian3 products

python2.7< 2.7.16-2
python3.4< 3.4.2-1+deb8u5
debian_linuxEOL8.0 | 9.0

Alpine2 products

python2< 2.7.16-r1 | < 2.7.15-r2
python2-tkinter< 2.7.17-r0

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.04

Fedoraproject1 product

fedoraEOL29 | 30

Mageia1 product

python< 2.7.15-1.4.mga6

Opensuse1 product

leapEOL15.0 | 42.3

Python1 product

python≥ 2.0, < 2.7.17 | ≥ 3.5.0, < 3.5.8 | ≥ 3.6.0, < 3.6.9 | ≥ 3.7.0, < 3.7.4

9 vendors · 20 products

References

33 links

bugs.python.org/issue35907X Refsource MISCExploitIssue TrackingVendor Advisory
github.com/python/cpython/pull/11842X Refsource MISCREPORTPatchThird Party Advisory
www.securityfocus.com/bid/107549VDB EntryX Refsource BIDThird Party Advisory
security.netapp.com/advisory/ntap-20190404-0004/X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlMailing ListX Refsource MLISTThird Party Advisory
access.redhat.com/errata/RHSA-2019:1700Vendor AdvisoryX Refsource REDHATThird Party Advisory
lists.debian.org/debian-lts-announce/2019/07/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA

Show all 33 references

lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
access.redhat.com/errata/RHSA-2019:2030Vendor AdvisoryX Refsource REDHATThird Party Advisory
usn.ubuntu.com/4127-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
usn.ubuntu.com/4127-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
seclists.org/bugtraq/2019/Oct/29Mailing ListX Refsource BUGTRAQThird Party Advisory
packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.htmlX Refsource MISCThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2019:3335Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2019:3520Vendor AdvisoryX Refsource REDHATThird Party Advisory
security.gentoo.org/glsa/202003-26Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.debian.org/debian-lts-announce/2020/07/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.debian.org/debian-lts-announce/2020/08/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
security.alpinelinux.org/vuln/CVE-2019-9948Advisory
advisories.mageia.org/MGASA-2019-0165.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=24758REPORT
lists.opensuse.org/opensuse-updates/2019-04/msg00187.htmlWEB
ubuntu.com/security/CVE-2019-9948REPORT
ubuntu.com/security/notices/USN-4127-1Advisory
ubuntu.com/security/notices/USN-4127-2Advisory
www.cve.org/CVERecord?id=CVE-2019-9948REPORT
ubuntu.com/security/notices/USN-6891-1Advisory
security-tracker.debian.org/tracker/CVE-2019-9948Advisory
cert-portal.siemens.com/productcert/html/ssa-398330.html