UBUNTU-CVE-2019-17514

    Dashboard / Vulnerabilities / UBUNTU-CVE-2019-17514

    UBUNTU-CVE-2019-17514

    Published: 12 Oct 2019Last Modified: 8 Sept 2026
    Upstream:
    CVE-2019-17514

    Summary:

    Details: library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.

    References: https://ubuntu.com/security/CVE-2019-17514, https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L380, https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L405, https://pubs.acs.org/doi/full/10.1021/acs.orglett.9b03216, https://pubs.acs.org/doi/suppl/10.1021/acs.orglett.9b03216/suppl_file/ol9b03216_si_002.zip, https://twitter.com/chris_bloke/status/1181997278136958976, https://twitter.com/LucasCMoore/status/1181615421922824192, https://web.archive.org/web/20150822013622/https://docs.python.org/3/library/glob.html, https://web.archive.org/web/20150906020027/https://docs.python.org/2.7/library/glob.html, https://web.archive.org/web/20160309211341/https://docs.python.org/3/library/glob.html, https://web.archive.org/web/20160526201356/https://docs.python.org/2.7/library/glob.html, https://www.vice.com/en_us/article/zmjwda/a-code-glitch-may-have-caused-errors-in-more-than-100-published-studies, https://ubuntu.com/security/notices/USN-4428-1, https://ubuntu.com/security/notices/USN-4754-3, https://www.cve.org/CVERecord?id=CVE-2019-17514, https://ubuntu.com/security/notices/USN-6891-1

    Affected packages

    Package

    Name: python2.7

    Purl: pkg:deb/ubuntu/python2.7?arch=source&distro=trusty%2Fesm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.7.6-8ubuntu0.6+esm6

    Affected versions

    2.7.5-8ubuntu3
    2.7.5-8ubuntu4
    2.7.6-2
    2.7.6-2ubuntu1
    2.7.6-3
    2.7.6-3ubuntu1
    2.7.6-4
    2.7.6-4ubuntu1
    2.7.6-5
    2.7.6-7
    2.7.6-8
    2.7.6-8ubuntu0.2
    2.7.6-8ubuntu0.3
    2.7.6-8ubuntu0.4
    2.7.6-8ubuntu0.5
    2.7.6-8ubuntu0.6+esm2
    2.7.6-8ubuntu0.6+esm3
    2.7.6-8ubuntu0.6+esm5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2019-17514 | CVE-DB