CVE-2019-16935

2019-09-2800:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

59.2%

JSON

The documentation XML-RPC server in Python through 2.7.16, 3.x through
3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This
occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py
in Python 3.x. If set_server_title is called with untrusted input,
arbitrary JavaScript can be delivered to clients that visit the http URL
for this server.

Bugs

<https://bugs.python.org/issue38243>

Notes

Author	Note
leosilva	this bug address to the docxmlrpc test hang issue: https://bugs.python.org/issue27614.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpython2.7< 2.7.15-4ubuntu4~18.04.2UNKNOWN
ubuntu19.04noarchpython2.7< 2.7.16-2ubuntu0.2UNKNOWN
ubuntu14.04noarchpython2.7< 2.7.6-8ubuntu0.6+esm3UNKNOWN
ubuntu16.04noarchpython2.7< 2.7.12-1ubuntu0~16.04.9UNKNOWN
ubuntu14.04noarchpython3.4< 3.4.3-1ubuntu1~14.04.7+esm4UNKNOWN
ubuntu14.04noarchpython3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1UNKNOWN
ubuntu16.04noarchpython3.5< 3.5.2-2ubuntu0~16.04.9UNKNOWN
ubuntu18.04noarchpython3.6< 3.6.8-1~18.04.3UNKNOWN
ubuntu19.04noarchpython3.7< 3.7.3-2ubuntu0.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	python2.7	< 2.7.15-4ubuntu4~18.04.2	UNKNOWN
ubuntu	19.04	noarch	python2.7	< 2.7.16-2ubuntu0.2	UNKNOWN
ubuntu	14.04	noarch	python2.7	< 2.7.6-8ubuntu0.6+esm3	UNKNOWN
ubuntu	16.04	noarch	python2.7	< 2.7.12-1ubuntu0~16.04.9	UNKNOWN
ubuntu	14.04	noarch	python3.4	< 3.4.3-1ubuntu1~14.04.7+esm4	UNKNOWN
ubuntu	14.04	noarch	python3.5	< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1	UNKNOWN
ubuntu	16.04	noarch	python3.5	< 3.5.2-2ubuntu0~16.04.9	UNKNOWN
ubuntu	18.04	noarch	python3.6	< 3.6.8-1~18.04.3	UNKNOWN
ubuntu	19.04	noarch	python3.7	< 3.7.3-2ubuntu0.2	UNKNOWN