Maple Labs

CVE search · CVE-2018-20852

CVE-2018-20852

medium 4.3

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
cve@mitre.org
Weakness
CWE-20

Severity

VersionScoreVectorSource
CVSS 3.1 medium 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N 134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary
CVSS 3.0 medium 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N nvd@nist.govPrimary
CVSS 2.0 medium 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References