CVE编号
CVE-2019-16935利用情况
暂无补丁情况
官方补丁披露时间
2019-09-28漏洞描述
Python是Python软件基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。documentation XML-RPC server是其中的一个XML-RPC（远程过程调用的分布式计算协议）服务器。 Python 2.7.16及之前版本、3.x版本至3.6.9版本和3.7.x版本至3.7.4版本中的documentation XML-RPC服务器存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html | |
| http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html | |
| https://bugs.python.org/issue38243 | |
| https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d82... | |
| https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520... | |
| https://github.com/python/cpython/pull/16373 | |
| https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html | |
| https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://security.netapp.com/advisory/ntap-20191017-0004/ | |
| https://usn.ubuntu.com/4151-1/ | |
| https://usn.ubuntu.com/4151-2/ | |
| https://www.oracle.com/security-alerts/cpujul2020.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | python | python | * |
Up to (including) 2.7.16 |
|||||
| 运行在以下环境 | |||||||||
| 应用 | python | python | * |
From (including) 3.0 |
Up to (including) 3.6.9 |
||||
| 运行在以下环境 | |||||||||
| 应用 | python | python | * |
From (including) 3.7.0 |
Up to (including) 3.7.4 |
||||
| 运行在以下环境 | |||||||||
| 系统 | alibaba_cloud_linux_2.1903 | python3 | * |
Up to (excluding) 2.7.5-89.1.al7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.10 | python3 | * |
Up to (excluding) 2.7.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.11 | python3 | * |
Up to (excluding) 2.7.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.12 | python3 | * |
Up to (excluding) 3.7.5-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.13 | python3 | * |
Up to (excluding) 3.7.5-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.14 | jython | * |
Up to (excluding) 3.7.5-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.15 | jython | * |
Up to (excluding) 2.7.16-r3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.7 | python3 | * |
Up to (excluding) 3.6.9-r1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.8 | python3 | * |
Up to (excluding) 3.6.9-r1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.9 | python3 | * |
Up to (excluding) 3.6.9-r2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_edge | python3 | * |
Up to (excluding) 2.7.16-r3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_AMI | python3 | * |
Up to (excluding) 3.5.7-1.25.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | jython | * |
Up to (excluding) 2.7.16-1.131.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | jython | * |
Up to (excluding) 3.6.8-31.el8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | python3 | * |
Up to (excluding) 2.7.16-2+deb10u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_11 | python3 | * |
Up to (excluding) 2.7.2+repack1-3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_12 | jython | * |
Up to (excluding) 2.7.2+repack1-4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | python3 | * |
Up to (excluding) 2.7.13-2+deb9u5 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_sid | python3 | * |
Up to (excluding) 2.7.2+repack1-4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_29 | python3 | * |
Up to (excluding) 3.5.8-2.fc29 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_30 | python3 | * |
Up to (excluding) 3.5.8-2.fc30 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_31 | python3 | * |
Up to (excluding) 3.6.10-1.fc31 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.0 | python3 | * |
Up to (excluding) 2.7.14-lp150.6.21.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.1 | python3 | * |
Up to (excluding) 3.6.9-lp151.6.4.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.2 | jython | * |
Up to (excluding) 3.6.12-lp152.4.14.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_7 | python3 | * |
Up to (excluding) 2.7.5-89.0.1.el7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_8 | python3 | * |
Up to (excluding) 3.6.8-31.0.1.el8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | jython | * |
Up to (excluding) 2.7.5-89.0.1.el7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_8 | jython | * |
Up to (excluding) 3.6.8-31.0.1.el8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | python | * |
Up to (excluding) 0:2.7.5-89.el7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | python3 | * |
Up to (excluding) 0:3.6.8-17.el7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | jython | * |
Up to (excluding) 3.6.8-31.el8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12 | libpython2_7-1_0 | * |
Up to (excluding) 2.7.13-28.36 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12_SP4 | python3 | * |
Up to (excluding) 2.7.13-28.36.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12_SP5 | python3 | * |
Up to (excluding) 3.4.10-25.52.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP4 | jython | * |
Up to (excluding) 2.7.13-28.36.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP5 | jython | * |
Up to (excluding) 3.4.10-25.52.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_14.04 | jython | * |
Up to (excluding) 3.4.3-1ubuntu1~14.04.7+esm4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_14.04_lts | python2.7 | * |
Up to (excluding) 2.7.6-8ubuntu0.6+esm3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04 | jython | * |
Up to (excluding) 3.5.2-2ubuntu0~16.04.9 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04_lts | python2.7 | * |
Up to (excluding) 2.7.12-1ubuntu0~16.04.9 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | jython | * |
Up to (excluding) 2.7.15-4ubuntu4~18.04.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04_lts | python2.7 | * |
Up to (excluding) 2.7.15-4ubuntu4~18.04.2 |
|||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 越权影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...