CVE-2019-16935

Description

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

How to fix CVE-2019-16935

To remediate CVE-2019-16935, upgrade the affected package to a fixed version below.

• —upgrade to 2.7.16-r3 or later
• —upgrade to 3.7.5-r0 or later
• —no fix listed
• —upgrade to 7.3.2+dfsg-1 or later
• —upgrade to 2.7.17~rc1-1 or later
• —upgrade to 2.7.13-2+deb9u5 or later

Is CVE-2019-16935 being exploited?

Low — EPSS is 2.5%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• from 0, < 2.7.16-r3
• from 0, < 3.7.5-r0
• from 0
• from 0, < 7.3.2+dfsg-1
• from 0, < 2.7.17~rc1-1
• from 0, < 2.7.13-2+deb9u5

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2019-16935
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2019-16935