CVE-2019-9947

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

Security Fix(es):

• numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446)

• python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

• python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

• python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

Security Fix(es):

• numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446)

• python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

• python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

• python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

• python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

• python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Updated python and python3 packages fix security vulnerabilities:

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n followed by an HTTP header or a Redis command (CVE-2019-9740).

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL) followed by an HTTP header or a Redis command. This is similar to CVE-2019-9740 query string issue (CVE-2019-9947).

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call (CVE-2019-9948).

A security regression of CVE-2019-9636 was discovered in python, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application (CVE-2019-10160).

It was discovered that Python incorrectly parsed certain email addresses. A remote attacker could possibly use this issue to trick Python applications into accepting email addresses that should be denied (CVE-2019-16056).

It was discovered that the Python documentation XML-RPC server incorrectly handled certain fields. A remote attacker could use this issue to execute a cross-site scripting (XSS) attack (CVE-2019-16935).

This update for python fixes the following issues:

Security issues fixed:

• CVE-2019-9947: Fixed an insufficient validation of URL paths with embedded whitespace or control characters that could allow HTTP header injections. (bsc#1130840)
• CVE-2019-16056: Fixed a parser issue in the email module. (bsc#1149955)
• CVE-2019-16935: Fixed a reflected XSS in python/Lib/DocXMLRPCServer.py (bsc#1153238).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues:

Security issues fixed:

• CVE-2019-9947: Fixed an insufficient validation of URL paths with embedded whitespace or control characters that could allow HTTP header injections. (bsc#1130840)
• CVE-2019-16056: Fixed a parser issue in the email module. (bsc#1149955)
• CVE-2019-16935: Fixed a reflected XSS in python/Lib/DocXMLRPCServer.py (bsc#1153238).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python3 to version 3.6.10 fixes the following issues:

• CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
• CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
• CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the python-2.7.18-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.0rc1-4.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python38-3.8.12-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.7-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.0b1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.0a7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.0~b3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for python-boto3, python-botocore and python-futures fixes the following issues:

python-botocore was updated to 1.13.33:

• Fix for python3-botocore versioning issues between SLES12 SP3 Teradata and Public Cloud Module. (bsc#1129696)
• Remove the broken attempt to avoid using the bundled requests module provided by the source. (boo#1088310)
• Update to the latest SDK components. (bsc#1146853, bsc#1146854)
• Add support for urllib 1.25 for CVE-2019-9947. (boo#1136184)
• Fix implementing MD5 header injection into new operations if they are necessary and create default session configuration. (bsc#1118021, bsc#1118024, bsc#1118027)
• Add attribute 'ssl_context' to 'AWSHTTPSConnection'. (bsc#1095041)

python-boto3 was updated to 1.10.33.

python-futures also provides python2-futures in the python2 build.

This update for python3 to version 3.6.8 fixes the following issues:

Security issue fixed:

• CVE-2019-9947: Fixed an issue in urllib2 which allowed CRLF injection if the attacker controls a url parameter (bsc#1130840).

Non-security issue fixed:

• Fixed broken debuginfo packages by switching off LTO and PGO optimization (bsc#1133452).

This update for python3 to version 3.6.8 fixes the following issues:

Security issue fixed:

• CVE-2019-9947: Fixed an issue in urllib2 which allowed CRLF injection if the attacker controls a url parameter (bsc#1130840).

Non-security issue fixed:

• Fixed broken debuginfo packages by switching off LTO and PGO optimization (bsc#1133452).

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

• Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

• Various security fixes: MFSA 2019-33 (bsc#1154738)

  • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
  • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
  • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
  • CVE-2019-11759: Stack buffer overflow in HKDF output
  • CVE-2019-11760: Stack buffer overflow in WebRTC networking
  • CVE-2019-11761: Unintended access to a privileged JSONView object
  • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
  • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
  • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

• [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
• [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
• [bsc#1043008] Firefox hangs randomly when browsing and scrolling
• [bsc#1025108] Firefox stops loading page until mouse is moved
• [bsc#905528] Firefox malfunctions due to broken omni.ja archives

This update for python fixes the following issues:

Security issues fixed:

• CVE-2019-9947: Fixed an insufficient validation of URL paths with embedded whitespace or control characters that could allow HTTP header injections. (bsc#1130840)
• CVE-2019-16056: Fixed a parser issue in the email module. (bsc#1149955)
• CVE-2019-16935: Fixed a reflected XSS in python/Lib/DocXMLRPCServer.py (bsc#1153238).

This update for python3 to version 3.6.10 fixes the following issues:

• CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
• CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).
• CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update for python fixes the following issues:

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

This update for python36 to version 3.6.10 fixes the following issues:

• CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).
• CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ signs (bsc#1149955).
• CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

This update for python3 fixes the following issues:

• CVE-2019-20907: Fixed denial of service by avoiding possible infinite loop in specifically crafted tarball (bsc#1174091).
• CVE-2020-14422: Fixed an improper computation of hash values in the IPv4Interface and IPv6Interface could have led to denial of service (bsc#1173274).
• CVE-2019-16935: Fixed a reflected XSS in python/Lib/DocXMLRPCServer.py (bsc#1153238).
• CVE-2019-9947: Fixed an issue in urllib2 which allowed CRLF injection if the attacker controls a url parameter (bsc#1130840).
• If the locale is 'C', coerce it to C.UTF-8 (bsc#1162423).

This update for python311, python-rpm-macros fixes the following issues:

python311:

• CVE-2024-0450: Fixed zipfile module vulnerability with "quoted-overlap" zipbomb (bsc#1221854)
• CVE-2024-4032: Fixed incorrect IPv4 and IPv6 private ranges (bsc#1226448)
• CVE-2024-0397: Fixed memory race condition in ssl.SSLContext certificate store methods (bsc#1226447)
• CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
• Fixed executable bits for /usr/bin/idle* (bsc#1227378).

python-rpm-macros:

• Update to version 20240618.c146b29:

  • Add %FLAVOR_pytest and %FLAVOR_pyunittest variants

• Update to version 20240618.1e386da:

  • Fix python_clone sed regex

• Update to version 20240614.02920b8:

  • Make sure that RPM_BUILD_ROOT env is set
  • don't eliminate any cmdline arguments in the shebang line
  • Create python313 macros

• Update to version 20240415.c664b45:

  • Fix typo 310 -> 312 in default-prjconf

• Update to version 20240202.501440e:

  • SPEC0: Drop python39, add python312 to buildset (#169)

• Update to version 20231220.98427f3:

  • fix python2_compile macro

• Update to version 20231207.46c2ec3:

  • make FLAVOR_compile compatible with python2

• Update to version 20231204.dd64e74:

  • Combine fix_shebang in one line
  • New macro FLAVOR_fix_shebang_path
  • Use realpath in %python_clone macro shebang replacement
  • Compile and fix_shebang in %python_install macros

• Update to version 20231010.0a1f0d9:

  • Revert "Compile and fix_shebang in %python_install macros"
  • gh#openSUSE/python-rpm-macros#163

• Update to version 20231010.a32e110:

  • Compile and fix_shebang in %python_install macros

• Update to version 20231005.bf2d3ab:

  • Fix shebang also in sbin with macro _fix_shebang

This update for python311 fixes the following issues:

• Skip PGO with %want_reproducible_builds (bsc#1239210)

• CVE-2025-0938: Disallows square brackets ([ and ]) in domain names for parsed URLs (bsc#1236705).

• Configure externally_managed with a bcond (bsc#1228165).

• Update to 3.11.11:

  • Tools/Demos
    • gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15 and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  • Tests
    • gh-125041: Re-enable skipped tests for zlib on the s390x architecture: only skip checks of the compressed bytes, which can be different between zlib’s software implementation and the hardware-accelerated implementation.
  • Security
    • gh-126623: Upgrade libexpat to 2.6.4
    • gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
  • Library
    • gh-124651: Properly quote template strings in venv activation scripts (bsc#1232241, CVE-2024-9287).

• Remove -IVendor/ from python-config (bsc#1231795)

• CVE-2024-9287: Properly quote path names provided when creating a virtual environment (bsc#1232241)

• Drop .pyc files from docdir for reproducible builds (bsc#1230906).

• Update to 3.11.10:

  • Security
    • gh-123678: Upgrade libexpat to 2.6.3
    • gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for python -i, as well as for python -m asyncio. The event in question is cpython.run_stdin.
    • gh-122133: Authenticate the socket connection for the socket.socketpair() fallback on platforms where AF_UNIX is not available like Windows. Patch by Gregory P. Smith [email protected] and Seth Larson [email protected]. Reported by Ellie [email protected]
    • gh-121285: Remove backtracking from tarfile header parsing for hdrcharset, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232).
    • gh-118486: :func:os.mkdir on Windows now accepts mode of 0o700 to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:tempfile.mkdtemp in scenarios where the base temporary directory is more permissive than the default.
    • gh-116741: Update bundled libexpat to 2.6.2
  • Library
    • gh-123270: Applied a more surgical fix for malformed payloads in :class:zipfile.Path causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088).
    • gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes by :mod:http.cookies (bsc#1229596, CVE-2024-7592).
    • gh-122905: :class:zipfile.Path objects now sanitize names from the zipfile.
    • gh-121650: :mod:email headers with embedded newlines are now quoted on output. The :mod:~email.generator will now refuse to serialize (write) headers that are unsafely folded or delimited; see :attr:~email.policy.Policy.verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in :gh:121650; CVE-2024-6923, bsc#1228780).
    • gh-119506: Fix :meth:!io.TextIOWrapper.write method breaks internal buffer when the method is called again during flushing internal buffer.
    • gh-118643: Fix an AttributeError in the :mod:email module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list.
    • gh-113171: Fixed various false positives and false negatives in * :attr:ipaddress.IPv4Address.is_private (see these docs for details) * :attr:ipaddress.IPv4Address.is_global * :attr:ipaddress.IPv6Address.is_private * …

This update for python311 fixes the following issues:

• CVE-2025-6069: Avoid worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705).

Update to 3.11.13:

• Security

  • gh-135034: Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138 (bsc#1244059), CVE-2025-4330 (bsc#1244060), and CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435 (gh#135034, bsc#1244061).
  • gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler (CVE-2025-4516, bsc#1243273).
  • gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service.

• Library

  • gh-128840: Fix parsing long IPv6 addresses with embedded IPv4 address.
  • gh-134062: ipaddress: fix collisions in hash() for IPv4Network and IPv6Network objects.
  • gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  • bpo-43633: Improve the textual representation of IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2) in ipaddress. Patch by Oleksandr Pavliuk.

• CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS. (bsc#1243273)

It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-20406)

It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852)

Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160)

Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010)

It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947)

Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blocklist meschanisms. (CVE-2019-9948)

USN-4127-1 fixed several vulnerabilities in Python. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-20406)

It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852)

Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160)

Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2019-5010)

It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947)

Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blocklist meschanisms. (CVE-2019-9948)