| Package | Affected versions | Patched versions |
|---|---|---|
| python | ≥ 2.0, < 2.7.17≥ 3.5.0, < 3.5.8≥ 3.6.0, < 3.6.9≥ 3.7.0, < 3.7.4 | 2.7.173.5.83.6.93.7.4 |
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free