CVE:CVE-2019-9948
CNNVD:CNNVD-201903-876
Python是Python软件基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。urllib是其中的一个用于处理URL的模块。
Python 2.x版本至2.7.16版本中的urllib存在路径遍历漏洞，该漏洞源于程序支持local_file: scheme。远程攻击者可利用该漏洞绕过保护机制。
solution:Upgrade python python to a higher version than 2.7.17,3.5.8,3.6.9,3.7.4,and avoid the version [2.0,2.7.17),[3.5.0,3.5.8),[3.6.0,3.6.9),[3.7.0,3.7.4); Upgrade opensuse leap to a higher version than 15.0,42.3,and avoid the version 15.0,42.3; Upgrade debian debian_linux to a higher version than 8.0,9.0,and avoid the version 8.0,9.0; Upgrade fedoraproject fedora to a higher version than 29,30,and avoid the version 29,30; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,16.04,18.04,19.04,and avoid the version 12.04,14.04,16.04,18.04,19.04; Upgrade redhat enterprise_linux_desktop to a higher version than 7.0,8.0,and avoid the version 7.0,8.0; Upgrade redhat enterprise_linux_eus to a higher version than 8.1,8.2,8.4,8.6,and avoid the version 8.1,8.2,8.4,8.6; Upgrade redhat enterprise_linux_server to a higher version than 7.0,8.0,and avoid the version 7.0,8.0; Upgrade redhat enterprise_linux_server_eus to a higher version than 8.4,and avoid the version 8.4; Upgrade redhat enterprise_linux_tus to a higher version than 8.2,8.4,8.6,and avoid the version 8.2,8.4,8.6; Upgrade redhat enterprise_linux_workstation to a higher version than 7.0,8.0,and avoid the version 7.0,8.0