Description
The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | python2.7 | 2.7.1-7 | — |
| Debian 6.0 | python2.6 | 2.6.6-8+deb6u1 | DLA-25-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | python +5 | 2.6.6-20.el6 | RHSA-2011:0554 |
| RHEL 6 | python-docs | 2.6.6-2.el6 | RHSA-2011:0554 |
| RHEL 5 | python +4 | 2.4.3-44.el5 | RHSA-2011:0492 |
| RHEL 4 | python +4 | 2.3.4-14.10.el4 | RHSA-2011:0491 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 2 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 2 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python | 2.7.18-8.1 | openSUSE-SU-2024:11202-1 |
| openSUSE Tumbleweed | python-base | 2.7.12-1.4 | openSUSE-SU-2024:10536-1 |
Advisories 7
- RHSA-2011:0554 Red Hat Security Advisory: python security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:0492 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:0491 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DLA-25-1 python2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10536-1 libpython2_7-1_0-2.7.12-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11202-1 python-2.7.18-8.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2020:0234-1 Security update for python SUSE / openSUSE Security Updates · May 2, 2025
References
- [oss-security] 20110916 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list
- MDVSA-2011:096 vendor-advisory
- SUSE-SR:2011:009 vendor-advisory
- http://hg.python.org/cpython/rev/b2934d98dac1/
- USN-1592-1 vendor-advisory
- http://hg.python.org/cpython/rev/96a6c128822b/
- 51040 third-party-advisory
- 50858 third-party-advisory
- APPLE-SA-2011-10-12-3 vendor-advisory
- http://bugs.python.org/issue11662
- [oss-security] 20110324 CVE Request -- Python (urllib, urllib2): Improper management of ftp:// and file:// URL schemes mailing-list
- [oss-security] 20110328 Re: CVE Request -- Python (urllib, urllib2): Improper management of ftp:// and file:// URL schemes mailing-list
- 1025488 vdb-entry
- http://hg.python.org/cpython/file/96a6c128822b/Misc/NEWS
- https://bugzilla.redhat.com/show_bug.cgi?id=690560
- https://bugzilla.redhat.com/show_bug.cgi?id=737366
- USN-1596-1 vendor-advisory
- http://hg.python.org/cpython/file/b2934d98dac1/Misc/NEWS
- [oss-security] 20110911 CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list
- USN-1613-2 vendor-advisory
- http://support.apple.com/kb/HT5002
- https://www.djangoproject.com/weblog/2011/sep/10/127/
- 51024 third-party-advisory
- USN-1613-1 vendor-advisory
- [oss-security] 20110913 Re: CVE Request -- Django: v1.3.1, v1.2.7 multiple security flaws mailing-list
- https://www.djangoproject.com/weblog/2011/sep/09/