medium 5.3

CVE-2019-9636 json

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during N…

published 2019-03-08 7y ago modified 2026-10-14 26d ago also EUVD-2019-19005

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 7.7%; EPSS 7.7% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Is CVE-2019-9636 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-9636 updated 2026-11-04 cvss 9.8

python: Information Disclosure due to urlsplit improper NFKC normalization

Red Hat Enterprise Linux 5 python
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) python3-idle 3.6.8-2.el8_0, python3-test 3.6.8-2.el8_0, platform-python 3.6.8-2.el8_0, python3-tkinter 3.6.8-2.el8_0, babel 2.5.1-9.module+el8.0.0+2961+596d0223, pytz 2017.2-12.module+el8.0.0+2961+596d0223, +85 more
fixed: vendor fix RHSA-2019:0981
Red Hat Enterprise Linux BaseOS (v. 8) python3 3.6.8-2.el8_0, python3-libs 3.6.8-2.el8_0, python3-test 3.6.8-2.el8_0, platform-python 3.6.8-2.el8_0
fixed: vendor fix RHSA-2019:0997
Red Hat Enterprise Linux Client (v. 7) python 2.7.5-77.el7_6, python-libs 2.7.5-77.el7_6 Red Hat Enterprise Linux Client Optional (v. 7) tkinter 2.7.5-77.el7_6, python-test 2.7.5-77.el7_6, python-tools 2.7.5-77.el7_6 Red Hat Enterprise Linux ComputeNode (v. 7) python 2.7.5-77.el7_6, python-libs 2.7.5-77.el7_6
fixed: vendor fix RHSA-2019:0710
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) python 2.7.5-70.el7_5, python-libs 2.7.5-70.el7_5
fixed: vendor fix RHSA-2019:2980
Red Hat Enterprise Linux ComputeNode Optional (v. 7) tkinter 2.7.5-77.el7_6, python-test 2.7.5-77.el7_6, python-tools 2.7.5-77.el7_6
fixed: vendor fix RHSA-2019:0710
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) tkinter 2.7.5-70.el7_5, python-test 2.7.5-70.el7_5, python-tools 2.7.5-70.el7_5
fixed: vendor fix RHSA-2019:2980
Red Hat Enterprise Linux Desktop (v. 6) python 2.6.6-68.el6_10, tkinter 2.6.6-68.el6_10, python-libs 2.6.6-68.el6_10 Red Hat Enterprise Linux Desktop Optional (v. 6) python-test 2.6.6-68.el6_10, python-tools 2.6.6-68.el6_10
fixed: vendor fix RHSA-2019:1467

show 16 more

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) python 2.7.5-77.el7_6, python-libs 2.7.5-77.el7_6 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) tkinter 2.7.5-77.el7_6, python-test 2.7.5-77.el7_6, python-tools 2.7.5-77.el7_6
fixed: vendor fix RHSA-2019:0710
Red Hat Enterprise Linux HPC Node (v. 6) python 2.6.6-68.el6_10, python-libs 2.6.6-68.el6_10 Red Hat Enterprise Linux HPC Node Optional (v. 6) tkinter 2.6.6-68.el6_10, python-test 2.6.6-68.el6_10, python-tools 2.6.6-68.el6_10 Red Hat Enterprise Linux Server (v. 6) python 2.6.6-68.el6_10, tkinter 2.6.6-68.el6_10, python-libs 2.6.6-68.el6_10
fixed: vendor fix RHSA-2019:1467
Red Hat Enterprise Linux Server (v. 7) python 2.7.5-77.el7_6, python-libs 2.7.5-77.el7_6
fixed: vendor fix RHSA-2019:0710
Red Hat Enterprise Linux Server AUS (v. 7.4) python 2.7.5-59.el7_4, python-libs 2.7.5-59.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.4) python 2.7.5-59.el7_4, python-libs 2.7.5-59.el7_4
fixed: vendor fix RHSA-2019:3170
Red Hat Enterprise Linux Server EUS (v. 7.5) python 2.7.5-70.el7_5, python-libs 2.7.5-70.el7_5
fixed: vendor fix RHSA-2019:2980
Red Hat Enterprise Linux Server Optional (v. 6) tkinter 2.6.6-68.el6_10, python-test 2.6.6-68.el6_10, python-tools 2.6.6-68.el6_10
fixed: vendor fix RHSA-2019:1467
Red Hat Enterprise Linux Server Optional (v. 7) tkinter 2.7.5-77.el7_6, python-test 2.7.5-77.el7_6, python-tools 2.7.5-77.el7_6
fixed: vendor fix RHSA-2019:0710
Red Hat Enterprise Linux Server Optional AUS (v. 7.4) tkinter 2.7.5-59.el7_4, python-test 2.7.5-59.el7_4, python-tools 2.7.5-59.el7_4 Red Hat Enterprise Linux Server Optional E4S (v. 7.4) tkinter 2.7.5-59.el7_4, python-test 2.7.5-59.el7_4, python-tools 2.7.5-59.el7_4
fixed: vendor fix RHSA-2019:3170
Red Hat Enterprise Linux Server Optional EUS (v. 7.5) tkinter 2.7.5-70.el7_5, python-test 2.7.5-70.el7_5, python-tools 2.7.5-70.el7_5
fixed: vendor fix RHSA-2019:2980
Red Hat Enterprise Linux Server Optional TUS (v. 7.4) tkinter 2.7.5-59.el7_4, python-test 2.7.5-59.el7_4, python-tools 2.7.5-59.el7_4 Red Hat Enterprise Linux Server TUS (v. 7.4) python 2.7.5-59.el7_4, python-libs 2.7.5-59.el7_4
fixed: vendor fix RHSA-2019:3170
Red Hat Enterprise Linux Workstation (v. 6) python 2.6.6-68.el6_10, tkinter 2.6.6-68.el6_10, python-libs 2.6.6-68.el6_10
fixed: vendor fix RHSA-2019:1467
Red Hat Enterprise Linux Workstation (v. 7) python 2.7.5-77.el7_6, python-libs 2.7.5-77.el7_6
fixed: vendor fix RHSA-2019:0710
Red Hat Enterprise Linux Workstation Optional (v. 6) python-test 2.6.6-68.el6_10, python-tools 2.6.6-68.el6_10
fixed: vendor fix RHSA-2019:1467
Red Hat Enterprise Linux Workstation Optional (v. 7) tkinter 2.7.5-77.el7_6, python-test 2.7.5-77.el7_6, python-tools 2.7.5-77.el7_6
fixed: vendor fix RHSA-2019:0710
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) python27-python 2.7.13-4.el6, python27-tkinter 2.7.13-4.el6, rh-python36-python 3.6.3-4.el6, rh-python35-python 3.5.1-12.el6, python27-python-libs 2.7.13-4.el6, python27-python-test 2.7.13-4.el6, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-python 2.7.13-6.el7, python27-tkinter 2.7.13-6.el7, rh-python36-python 3.6.3-7.el7, rh-python35-python 3.5.1-12.el7, python27-python-libs 2.7.13-6.el7, python27-python-test 2.7.13-6.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) python27-python 2.7.13-6.el7, python27-tkinter 2.7.13-6.el7, rh-python36-python 3.6.3-7.el7, rh-python35-python 3.5.1-12.el7, python27-python-libs 2.7.13-6.el7, python27-python-test 2.7.13-6.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) python27-python 2.7.13-6.el7, python27-tkinter 2.7.13-6.el7, rh-python36-python 3.6.3-7.el7, rh-python35-python 3.5.1-12.el7, python27-python-libs 2.7.13-6.el7, python27-python-test 2.7.13-6.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) python27-python 2.7.13-6.el7, python27-tkinter 2.7.13-6.el7, rh-python36-python 3.6.3-7.el7, rh-python35-python 3.5.1-12.el7, python27-python-libs 2.7.13-6.el7, python27-python-test 2.7.13-6.el7, +9 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) python27-python 2.7.13-4.el6, python27-tkinter 2.7.13-4.el6, rh-python36-python 3.6.3-4.el6, rh-python35-python 3.5.1-12.el6, python27-python-libs 2.7.13-4.el6, python27-python-test 2.7.13-4.el6, +9 more

+1 more productsfewer

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-python 2.7.13-6.el7, python27-tkinter 2.7.13-6.el7, rh-python36-python 3.6.3-7.el7, rh-python35-python 3.5.1-12.el7, python27-python-libs 2.7.13-6.el7, python27-python-test 2.7.13-6.el7, +9 more

fixed: vendor fix RHSA-2019:0806
Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance 4.2-20190411.1.el7, redhat-virtualization-host 4.2-20190411.1.el7_6, redhat-virtualization-host-image-update 4.2-20190411.1.el7_6 Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance 4.2-20190411.1.el7
fixed: vendor fix RHBA-2019:0764

1 more fixed, 2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated 2025-08-12 cvss 9.8

Siemens SIMATIC S7-1500

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSMA-21-187-01 updated 2022-04-05 cvss 3.7

Philips Vue PACS (Update B)

Philips Vue Motion <= 12.2.1.5 Philips Vue MyVue <= 12.2.x.x
affected: vendor fix eservice.philips.com
Philips Vue PACS <= 12.2.x.x
affected: vendor fix incenter.medical.philips.com
Philips Vue Speech <= 12.2.x.x
affected: vendor fix eservice.philips.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: last mo. (2026-10-07)

Exploit prediction

7.67% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

CWE-173 Improper Handling of Alternate Encoding

References

github.com /python/cpython/pull/12201
patch, third-party-advisory
bugs.python.org /issue36216
issue-tracking, patch, vendor-advisory
python-security.readthedocs.io /vuln/urlsplit-nfkc-normalization.html
patch, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/
vendor-advisory
access.redhat.com /errata/RHSA-2019:0710
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:0765
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:0806
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2019-04/msg00092.html
vendor-advisory, mailing-list, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2019-04/msg00097.html
vendor-advisory, mailing-list, third-party-advisory
access.redhat.com /errata/RHSA-2019:0902
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:0981
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:0997
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHBA-2019:0959
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2019-05/msg00024.html
vendor-advisory, mailing-list, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/
vendor-advisory
access.redhat.com /errata/RHSA-2019:1467
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2019-06/msg00050.html
vendor-advisory, mailing-list, third-party-advisory
access.redhat.com /errata/RHBA-2019:0764
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHBA-2019:0763
vendor-advisory, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2019-08/msg00042.html
vendor-advisory, mailing-list, third-party-advisory
usn.ubuntu.com /4127-2/
vendor-advisory
usn.ubuntu.com /4127-1/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/
vendor-advisory
access.redhat.com /errata/RHSA-2019:2980
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:3170
vendor-advisory, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2020-01/msg00040.html
mailing-list, third-party-advisory
securityfocus.com /bid/107400
third-party-advisory, vdb-entry
lists.debian.org /debian-lts-announce/2019/06/msg00022.html
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2019/06/msg00023.html
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2020/07/msg00011.html
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2020/08/msg00034.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2019-9636
NVD CVE-2019-9636

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed