CVE-2019-17514
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading...
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.
- Record
CVE-2019-17514- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-682
- Updated
- 2026-11-02
CVE List No score
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.
- Record
CVE-2019-17514- Updated
- 2026-11-02
EUVDEUVD-2019-7866 No score
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.
- Record
EUVD-2019-7866- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pgrc-mvjg-qfr7
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading...
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.
- Record
GHSA-pgrc-mvjg-qfr7- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-682
- Updated
- 2026-11-02
OSV
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.
- Record
CVE-2019-17514- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-17514
library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.
- Record
UBUNTU-CVE-2019-17514- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2020-0451 No score
Updated python and python3 packages fix security vulnerabilities
It was discovered that incorrectly handled certain ZIP files. An attacker could possibly use this issue to cause a denial of service (CVE-2019-9674).
It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information (CVE-2019-17514).
It was discovered that Python incorrectly handled certain TAR archives. An attacker could possibly use this issue to cause a denial of service (CVE-2019-20907).
It was discovered that Python incorrectly handled certain HTTP requests. An attacker could possibly use this issue to cause a denial of service (CVE-2020-8492).
It was discovered that Python incorrectly handled certain IP values. An attacker could possibly use this issue to cause a denial of service (CVE-2020-14422).
It was discovered that Python incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform CRLF injection (CVE-2020-26116).
The CVE-2020-14422 issue only affected python3.
- Record
MGASA-2020-0451- Updated
- 2026-11-02
OSVUSN-4428-1 No score
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-17514)
It was discovered that Python incorrectly handled certain TAR archives. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-20907)
It was discovered that incorrectly handled certain ZIP files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9674)
It was discovered that Python incorrectly handled certain IP values. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14422)
- Record
USN-4428-1- Updated
- 2026-11-02
OSVUSN-4754-3 No score
python2.7, python3.7, python3.8 vulnerabilities
USN-4754-1 fixed vulnerabilities in Python. This update provides the corresponding updates for Ubuntu 18.04 and Ubuntu 20.04.
In the case of Python 2.7 for 20.04, these additional fixes are included:
It was dicovered that Python allowed remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. (CVE-2019-9674)
It was discovered that Python had potentially misleading information about whether sorting occurs. This fix updates the documentation about it. (CVE-2019-17514)
It was discovered that Python incorrectly handled certain TAR archives. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-20907)
It was discovered that Python allowed an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)
It was discovered that Python allowed CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)
Original advisory details:
It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)
- Record
USN-4754-3- Updated
- 2026-11-02
OSVUSN-6891-1 No score
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions vulnerable to catastrophic backtracking. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A remote attacker could possibly use this issue to cause hash collisions, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-14647)
It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9636, CVE-2019-10160)
It was discovered that Python incorrectly parsed certain email addresses. A remote attacker could possibly use this issue to trick Python applications into accepting email addresses that should be denied. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-16056)
It was discovered that the Python documentation XML-RPC server incorrectly handled certain fields. A remote attacker could use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-16935)
It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-17514)
It was discovered that Python incorrectly stripped certain characters from requests. A remote attacker could use this issue to perform CRLF injection. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-18348)
It was discovered that Python incorrectly handled certain TAR archives. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-20907)
Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-5010)
It was discovered that incorrectly handled certain ZIP files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9674)
It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9740, CVE-2019-9947)
Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blocklist meschanisms. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-9948)
It was discovered that Python incorrectly handled certain IP values. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-14422)
It was discovered that Python incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform CRLF injection. This issue only affected Ubuntu 14.04 LTS and Ubuntu…
- Record
USN-6891-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pythonMageia:7 |
before 2.7.18-1.1.mga7 | 2.7.18-1.1.mga7 |
python3Mageia:7 |
before 3.7.9-1.mga7 | 3.7.9-1.mga7 |
python2.7Ubuntu:Pro:14.04:LTS |
before 2.7.6-8ubuntu0.6+esm6, plus listed versions 2.7.5-8ubuntu32.7.5-8ubuntu42.7.6-22.7.6-2ubuntu12.7.6-3 Show 13 moreShow less2.7.6-3ubuntu12.7.6-42.7.6-4ubuntu12.7.6-52.7.6-72.7.6-82.7.6-8ubuntu0.22.7.6-8ubuntu0.32.7.6-8ubuntu0.42.7.6-8ubuntu0.52.7.6-8ubuntu0.6+esm22.7.6-8ubuntu0.6+esm32.7.6-8ubuntu0.6+esm5 |
2.7.6-8ubuntu0.6+esm6 |
python3.4Ubuntu:Pro:14.04:LTS |
before 3.4.3-1ubuntu1~14.04.7+esm7, plus listed versions 3.4~b1-0ubuntu33.4~b1-4ubuntu43.4~b1-4ubuntu63.4~b1-5ubuntu23.4~b2-1 Show 16 moreShow less3.4~b3-1ubuntu13.4~rc1-1build13.4~rc2-13.4~rc3-0ubuntu13.4.0-13.4.0-2ubuntu13.4.0-2ubuntu1.13.4.3-1ubuntu1~14.04.13.4.3-1ubuntu1~14.04.33.4.3-1ubuntu1~14.04.43.4.3-1ubuntu1~14.04.53.4.3-1ubuntu1~14.04.63.4.3-1ubuntu1~14.04.73.4.3-1ubuntu1~14.04.7+esm23.4.3-1ubuntu1~14.04.7+esm43.4.3-1ubuntu1~14.04.7+esm6 |
3.4.3-1ubuntu1~14.04.7+esm7 |
python3.5Ubuntu:Pro:14.04:LTS |
before 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1, plus listed versions 3.5.2-2ubuntu0~16.04.4~14.04.1 |
3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 |
python2.7Ubuntu:16.04:LTS |
before 2.7.12-1ubuntu0~16.04.12, plus listed versions 2.7.10-4ubuntu12.7.10-4ubuntu22.7.11-22.7.11-32.7.11-4 Show 11 moreShow less2.7.11-62.7.11-72.7.11-7ubuntu12.7.12-1~16.042.7.12-1ubuntu0~16.04.12.7.12-1ubuntu0~16.04.22.7.12-1ubuntu0~16.04.32.7.12-1ubuntu0~16.04.42.7.12-1ubuntu0~16.04.82.7.12-1ubuntu0~16.04.92.7.12-1ubuntu0~16.04.11 |
2.7.12-1ubuntu0~16.04.12 |
python3.5Ubuntu:16.04:LTS |
before 3.5.2-2ubuntu0~16.04.11, plus listed versions 3.5.0-33.5.0-3ubuntu13.5.1~rc1-2ubuntu13.5.1-13.5.1-2 Show 16 moreShow less3.5.1-33.5.1-53.5.1-6ubuntu13.5.1-6ubuntu23.5.1-9ubuntu13.5.1-103.5.2-2~16.013.5.2-2~16.043.5.2-2ubuntu0~16.04.13.5.2-2ubuntu0~16.04.23.5.2-2ubuntu0~16.04.33.5.2-2ubuntu0~16.04.43.5.2-2ubuntu0~16.04.53.5.2-2ubuntu0~16.04.83.5.2-2ubuntu0~16.04.93.5.2-2ubuntu0~16.04.10 |
3.5.2-2ubuntu0~16.04.11 |
python2.7Ubuntu:18.04:LTS |
before 2.7.17-1~18.04ubuntu1.1, plus listed versions 2.7.14-2ubuntu22.7.14-42.7.14-62.7.14-72.7.14-8 Show 7 moreShow less2.7.15~rc1-12.7.15~rc1-1ubuntu0.12.7.15-4ubuntu4~18.042.7.15-4ubuntu4~18.04.12.7.15-4ubuntu4~18.04.22.7.17-1~18.042.7.17-1~18.04ubuntu1 |
2.7.17-1~18.04ubuntu1.1 |
python3.6Ubuntu:18.04:LTS |
before 3.6.9-1~18.04ubuntu1.1, plus listed versions 3.6.3-1ubuntu13.6.4~rc1-13.6.4~rc1-23.6.4-13.6.4-2 Show 11 moreShow less3.6.4-3build13.6.4-43.6.5~rc1-13.6.5-33.6.6-1~18.043.6.7-1~18.043.6.8-1~18.04.13.6.8-1~18.04.23.6.8-1~18.04.33.6.9-1~18.043.6.9-1~18.04ubuntu1 |
3.6.9-1~18.04ubuntu1.1 |
python3.8Ubuntu:18.04:LTS |
before 3.8.0-3~18.04 | 3.8.0-3~18.04 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3.7Ubuntu:Pro:18.04:LTS |
before 3.7.5-2ubuntu1~18.04.2+esm3, plus listed versions 3.7.0~a2-13.7.0~a3-13.7.0~a3-23.7.0~a3-33.7.0~a4-1 Show 12 moreShow less3.7.0~b1-13.7.0~b1-1build13.7.0~b2-13.7.0~b3-13.7.0-1~18.043.7.1-1~18.043.7.3-2~18.04.13.7.5-2~18.043.7.5-2~18.04.43.7.5-2ubuntu1~18.04.23.7.5-2ubuntu1~18.04.2+esm13.7.5-2ubuntu1~18.04.2+esm2 |
3.7.5-2ubuntu1~18.04.2+esm3 |
python2.7Ubuntu:20.04:LTS |
before 2.7.18-1~20.04.1, plus listed versions 2.7.17~rc1-12.7.17-12.7.17-1ubuntu52.7.17-1ubuntu62.7.18~rc1-22.7.18-1~20.04 |
2.7.18-1~20.04.1 |
python3.8Ubuntu:20.04:LTS |
before 3.8.2-1ubuntu1.2, plus listed versions 3.8.0-13.8.0-23.8.0-33.8.0-43.8.0-5 Show 5 moreShow less3.8.1-2ubuntu33.8.2~rc1-1ubuntu13.8.2-13.8.2-1ubuntu13.8.2-1ubuntu1.1 |
3.8.2-1ubuntu1.2 |
python2.7Ubuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.7.18-8build12.7.18-132.7.18-13ubuntu12.7.18-13ubuntu1.12.7.18-13ubuntu1.1+esm2 Show 16 moreShow less2.7.18-13ubuntu1.22.7.18-13ubuntu1.2+esm12.7.18-13ubuntu1.2+esm22.7.18-13ubuntu1.2+esm32.7.18-13ubuntu1.32.7.18-13ubuntu1.3+esm12.7.18-13ubuntu1.42.7.18-13ubuntu1.4+esm12.7.18-13ubuntu1.52.7.18-13ubuntu1.5+esm22.7.18-13ubuntu1.5+esm32.7.18-13ubuntu1.5+esm52.7.18-13ubuntu1.5+esm62.7.18-13ubuntu1.5+esm72.7.18-13ubuntu1.5+esm82.7.18-13ubuntu1.5+esm9 |
None known |
python3.7Ubuntu:18.04:LTS |
before 3.7.5-2~18.04.4, plus listed versions 3.7.0~a2-13.7.0~a3-13.7.0~a3-23.7.0~a3-33.7.0~a4-1 Show 8 moreShow less3.7.0~b1-13.7.0~b1-1build13.7.0~b2-13.7.0~b3-13.7.0-1~18.043.7.1-1~18.043.7.3-2~18.04.13.7.5-2~18.04 |
3.7.5-2~18.04.4 |
python3.8Ubuntu:18.04:LTS |
before 3.8.0-3~18.04.1, plus listed versions 3.8.0-3~18.04 |
3.8.0-3~18.04.1 |
python3.5Ubuntu:Pro:16.04:LTS |
before 3.5.2-2ubuntu0~16.04.13+esm13, plus listed versions 3.5.0-33.5.0-3ubuntu13.5.1~rc1-2ubuntu13.5.1-13.5.1-2 Show 30 moreShow less3.5.1-33.5.1-53.5.1-6ubuntu13.5.1-6ubuntu23.5.1-9ubuntu13.5.1-103.5.2-2~16.013.5.2-2~16.043.5.2-2ubuntu0~16.04.13.5.2-2ubuntu0~16.04.23.5.2-2ubuntu0~16.04.33.5.2-2ubuntu0~16.04.43.5.2-2ubuntu0~16.04.53.5.2-2ubuntu0~16.04.83.5.2-2ubuntu0~16.04.93.5.2-2ubuntu0~16.04.103.5.2-2ubuntu0~16.04.113.5.2-2ubuntu0~16.04.123.5.2-2ubuntu0~16.04.133.5.2-2ubuntu0~16.04.13+esm13.5.2-2ubuntu0~16.04.13+esm23.5.2-2ubuntu0~16.04.13+esm33.5.2-2ubuntu0~16.04.13+esm53.5.2-2ubuntu0~16.04.13+esm63.5.2-2ubuntu0~16.04.13+esm73.5.2-2ubuntu0~16.04.13+esm83.5.2-2ubuntu0~16.04.13+esm93.5.2-2ubuntu0~16.04.13+esm103.5.2-2ubuntu0~16.04.13+esm113.5.2-2ubuntu0~16.04.13+esm12 |
3.5.2-2ubuntu0~16.04.13+esm13 |
python3.6Ubuntu:Pro:18.04:LTS |
before 3.6.9-1~18.04ubuntu1.13+esm2, plus listed versions 3.6.3-1ubuntu13.6.4~rc1-13.6.4~rc1-23.6.4-13.6.4-2 Show 22 moreShow less3.6.4-3build13.6.4-43.6.5~rc1-13.6.5-33.6.6-1~18.043.6.7-1~18.043.6.8-1~18.04.13.6.8-1~18.04.23.6.8-1~18.04.33.6.9-1~18.043.6.9-1~18.04ubuntu13.6.9-1~18.04ubuntu1.13.6.9-1~18.04ubuntu1.33.6.9-1~18.04ubuntu1.43.6.9-1~18.04ubuntu1.63.6.9-1~18.04ubuntu1.73.6.9-1~18.04ubuntu1.83.6.9-1~18.04ubuntu1.93.6.9-1~18.04ubuntu1.103.6.9-1~18.04ubuntu1.123.6.9-1~18.04ubuntu1.133.6.9-1~18.04ubuntu1.13+esm1 |
3.6.9-1~18.04ubuntu1.13+esm2 |
python3.8Ubuntu:Pro:18.04:LTS |
before 3.8.0-3ubuntu1~18.04.2+esm2, plus listed versions 3.8.0-3~18.043.8.0-3~18.04.13.8.0-3ubuntu1~18.04.23.8.0-3ubuntu1~18.04.2+esm1 |
3.8.0-3ubuntu1~18.04.2+esm2 |
python3.8Ubuntu:20.04:LTS |
before 3.8.10-0ubuntu1~20.04.10, plus listed versions 3.8.0-13.8.0-23.8.0-33.8.0-43.8.0-5 Show 18 moreShow less3.8.1-2ubuntu33.8.2~rc1-1ubuntu13.8.2-13.8.2-1ubuntu13.8.2-1ubuntu1.13.8.2-1ubuntu1.23.8.5-1~20.043.8.5-1~20.04.23.8.5-1~20.04.33.8.10-0ubuntu1~20.043.8.10-0ubuntu1~20.04.13.8.10-0ubuntu1~20.04.23.8.10-0ubuntu1~20.04.43.8.10-0ubuntu1~20.04.53.8.10-0ubuntu1~20.04.63.8.10-0ubuntu1~20.04.73.8.10-0ubuntu1~20.04.83.8.10-0ubuntu1~20.04.9 |
3.8.10-0ubuntu1~20.04.10 |
python3.9Ubuntu:Pro:20.04:LTS |
before 3.9.5-3ubuntu0~20.04.1+esm2, plus listed versions 3.9.0~rc1-1~20.043.9.0-5~20.043.9.5-3~20.04.13.9.5-3ubuntu0~20.04.13.9.5-3ubuntu0~20.04.1+esm1 |
3.9.5-3ubuntu0~20.04.1+esm2 |
python3.10Ubuntu:22.04:LTS |
before 3.10.12-1~22.04.4, plus listed versions 3.10.0-23.10.0-33.10.0-43.10.0-53.10.0-5build1 Show 15 moreShow less3.10.1-13.10.1-23.10.2-13.10.2-53.10.2-73.10.3-13.10.4-33.10.4-3ubuntu0.13.10.6-1~22.043.10.6-1~22.04.13.10.6-1~22.04.23.10.6-1~22.04.2ubuntu13.10.6-1~22.04.2ubuntu1.13.10.12-1~22.04.23.10.12-1~22.04.3 |
3.10.12-1~22.04.4 |
python3.11Ubuntu:Pro:22.04:LTS |
before 3.11.0~rc1-1~22.04.1~esm1, plus listed versions 3.11.0~rc1-1~22.04 |
3.11.0~rc1-1~22.04.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-17514 is a high vulnerability (CVSS 7.5) in Python, published October 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.67%, the 91st percentile. Fixed in python 2.7.18-1.1.mga7.
References
web.archive.org/web/20150906020027/https://docs.python.org/2.7/library/glob.html
github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c
bugs.python.org/issue33275
Show 62 moreShow less
twitter.com/LucasCMoore/status/1181615421922824192
pubs.acs.org/doi/suppl/10.1021/acs.orglett.9b03216/suppl_file/ol9b03216_si_002.zip
vice.com/en_us/article/zmjwda/a-code-glitch-may-have-caused-errors-in-more-than-100-published-studies
security.netapp.com/advisory/ntap-20191107-0005
usn.ubuntu.com/4428-1
nvd.nist.gov/vuln/detail/CVE-2019-17514
advisories.mageia.org/MGASA-2020-0451.html
bugs.mageia.org/show_bug.cgi?id=26268
ubuntu.com/security/notices/USN-4428-1
lists.fedoraproject.org/archives/list/[email protected]/thread/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC
access.redhat.com/errata/RHSA-2020:4273
cve.org/CVERecord?id=CVE-2019-17514
Left out here: the rest of 1 source description. The JSON record has them.