CVE-2018-20852: Input Validation
CVE-2018-20852 http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3. CVE-2014-4616 Array index error in the scanstring function in the json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the rawdecode function. CVE-2013-7040 Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.
Other sources
http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.
Upstream issue:
https://bugs.python.org/issue35121
References:
https://python-security.readthedocs.io/vuln/cookie-domain-check.html
— Red Hat
Python could allow a remote attacker to obtain sensitive information, caused by the failure to correctly validate the domain by http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py. By using a server with a hostname that has another valid hostname as a suffix, an attacker could exploit this vulnerability to obtain leaked existing cookies.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 0:2.7.5-88.el7 - Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 0:3.6.8-13.el7 - Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 0:3.6.8-23.el8 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.9-2.el6 - Upgrade
Upgrade
redhat/python27-pythonto a version that resolves this vulnerability.Fixed in 0:2.7.17-2.el6 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.9-2.el7 - Upgrade
Upgrade
redhat/python27-pythonto a version that resolves this vulnerability.Fixed in 0:2.7.17-2.el7 - Upgrade
Upgrade
redhat/Pythonto a version that resolves this vulnerability.Fixed in 3.4.10 - Upgrade
Upgrade
redhat/Pythonto a version that resolves this vulnerability.Fixed in 3.5.7 - Upgrade
Upgrade
redhat/Pythonto a version that resolves this vulnerability.Fixed in 3.6.9 - Upgrade
Upgrade
redhat/Pythonto a version that resolves this vulnerability.Fixed in 3.7.3 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.4.10 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.5.7 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.6.9 - Upgrade
Upgrade
Pythonto a version that resolves this vulnerability.Fixed in 3.7.3 - Upgrade
Upgrade
simplejsonto a version that resolves this vulnerability.Fixed in 2.6.1 - Configuration
Set DomainStrict in the cookiepolicy to require a literal domain match; this may prevent cookies set on example.com from being shared with subdomains.
Python http.cookiejar.DefaultPolicy DomainStrict = enabled
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-20852?
CVE-2018-20852 is a vulnerability in Python before version 3.7.3 that allows an attacker to trick the cookiejar into sending existing cookies to the wrong server.
How severe is CVE-2018-20852?
CVE-2018-20852 has a severity rating of 5.3 (Medium).
Which versions of Python are affected by CVE-2018-20852?
Python versions before 3.7.3 are affected by CVE-2018-20852.
How can I fix CVE-2018-20852?
To fix CVE-2018-20852, upgrade your Python version to 3.7.3 or later.
Where can I find more information about CVE-2018-20852?
You can find more information about CVE-2018-20852 at the following references: [1] [2] [3].