CVE-2019-10160

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

5.23% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 91.8% of scored records. A rank, not a probability.

NVD base score

9.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2019-06-07 17:50Z7 YR AGO

Last updated

2024-08-04 22:10Z2 YR AGO

Reserved

2019-03-27

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CNA CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

• CWE-172Encoding ErrorClass
• CWE-522Insufficiently Protected CredentialsClass

Data version

5.1

Document digest

bd51751dec7aa2cd5ec0e3054caa2b38ddb3b66e068382b3aac1b949b4a91986

• python-security.readthedocs.iohttps://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.htmlx_refsource_MISC
• bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160x_refsource_CONFIRM
• github.comhttps://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87ex_refsource_CONFIRM
• github.comhttps://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93dex_refsource_CONFIRM
• github.comhttps://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09x_refsource_CONFIRM
• github.comhttps://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468x_refsource_CONFIRM
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20190617-0003/x_refsource_CONFIRM
• access.redhat.comRHSA-2019:1587https://access.redhat.com/errata/RHSA-2019:1587vendor-advisoryx_refsource_REDHAT
• lists.debian.org[debian-lts-announce] 20190625 [SECURITY] [DLA 1834-1] python2.7 security updatehttps://lists.debian.org/debian-lts-announce/2019/06/msg00022.htmlmailing-listx_refsource_MLIST
• access.redhat.comRHSA-2019:1700https://access.redhat.com/errata/RHSA-2019:1700vendor-advisoryx_refsource_REDHAT
• lists.fedoraproject.orgFEDORA-2019-7723d4774ahttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2019-7df59302e0https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2019-9bfb4a3e4bhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2019-60a1defcd1https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/vendor-advisoryx_refsource_FEDORA
• access.redhat.comRHSA-2019:2437https://access.redhat.com/errata/RHSA-2019:2437vendor-advisoryx_refsource_REDHAT
• lists.opensuse.orgopenSUSE-SU-2019:1906http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.htmlvendor-advisoryx_refsource_SUSE
• usn.ubuntu.comUSN-4127-2https://usn.ubuntu.com/4127-2/vendor-advisoryx_refsource_UBUNTU
• usn.ubuntu.comUSN-4127-1https://usn.ubuntu.com/4127-1/vendor-advisoryx_refsource_UBUNTU
• lists.fedoraproject.orgFEDORA-2019-50772cf122https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2019-5dc275c9f2https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2019-2b1f72899ahttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2019-b06ec6159bhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2019-d202cda4f8https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2019-57462fa10dhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/vendor-advisoryx_refsource_FEDORA
• lists.opensuse.orgopenSUSE-SU-2020:0086http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlvendor-advisoryx_refsource_SUSE
• lists.debian.org[debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security updatehttps://lists.debian.org/debian-lts-announce/2020/07/msg00011.htmlmailing-listx_refsource_MLIST
• lists.apache.org[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 imagehttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Emailing-listx_refsource_MLIST
• lists.debian.org[debian-lts-announce] 20200822 [SECURITY] [DLA 2337-1] python2.7 security updatehttps://lists.debian.org/debian-lts-announce/2020/08/msg00034.htmlmailing-listx_refsource_MLIST