http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by us…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2018-20852 · Microsoft / collected KEV context

cve-program · CVE-2018-20852

• https://bugs.python.org/issue35121
• https://python-security.readthedocs.io/vuln/cookie-domain-check.html
• https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html
• https://lists.debian.org/debian-lts-announce/2019/08/msg00040.html
• https://usn.ubuntu.com/4127-2/
• https://usn.ubuntu.com/4127-1/
• https://access.redhat.com/errata/RHSA-2019:3725
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/
• https://access.redhat.com/errata/RHSA-2019:3948
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
• https://security.gentoo.org/glsa/202003-26
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html

No related operational record is retained in the current change model.