CVE-2018-20852

Updated: 2023-11-07 19:23:12.513034

Description:

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x MEDIUM 5
CVSS Version 3.x MEDIUM 5.3

Status

OS name Project name Version Score Severity Status Errata Last updated
CentOS 6 ELS python 2.6.6 5.3 MEDIUM Released CLSA-2021:1633442879 2022-05-05 12:01:57
CloudLinux 6 ELS python 2.6.6 5.3 MEDIUM Released 2021-11-02 14:03:18
Oracle Linux 6 ELS python 2.6.6 5.3 MEDIUM Not Vulnerable CLSA-2021:1634925483 2021-11-02 14:03:18
Ubuntu 16.04 ELS python2.7 2.7.12 5.3 MEDIUM Not Vulnerable 2021-11-02 14:03:18