---

CVE-2019-9636 - log back

CVE-2019-9636 created at 25 Sep 2019 19:31:40
Severity	+ High
Remote	+ Remote
Type	+ Information disclosure
Description	+ Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. A specially crafted URL could be incorrectly parsed by urllib.parse.urlsplit and urllib.parse.urlparse to locate cookies or authentication data and send that information to a different host than when parsed correctly.
References	+ https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html + https://github.com/python/cpython/commit/daad2c482c91de32d8305abbccc76a5de8b3a8be + https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de
Notes