Vulnetix
Try Vulnetix Request Demo
CVE-2019-17514 PUBLISHED

library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.

EPSS 1.71% · 82.2th percentile

Risk Scores

EPSS Score
1.71%
82.2th percentile

Affected Products

VendorProductVersions
Ubuntu:20.04:LTSpython2.72.7.18-1~20.04, 0, 2.7.17~rc1-1
Ubuntu:16.04:LTSpython3.53.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.10, 3.5.2-2ubuntu0~16.04.9
Ubuntu:Pro:14.04:LTSpython3.53.5.2-2ubuntu0~16.04.4~14.04.1, 0
Ubuntu:16.04:LTSpython2.72.7.11-7ubuntu1, 2.7.12-1~16.04, 2.7.12-1ubuntu0~16.04.1
Ubuntu:18.04:LTSpython3.80
Ubuntu:18.04:LTSpython3.63.6.5~rc1-1, 3.6.4-3build1, 3.6.4-2
Ubuntu:20.04:LTSpython3.83.8.2-1ubuntu1.1, 3.8.0-3, 3.8.0-2
Ubuntu:Pro:18.04:LTSpython3.73.7.5-2~18.04, 0, 3.7.0~a2-1
Ubuntu:Pro:14.04:LTSpython3.43.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.4
Ubuntu:Pro:14.04:LTSpython2.72.7.6-4ubuntu1, 0, 2.7.6-8ubuntu0.6+esm5
Ubuntu:18.04:LTSpython2.72.7.14-2ubuntu2, 2.7.14-4, 2.7.14-6
Ubuntu:Pro:22.04:LTSpython2.70, 2.7.18-8build1, 2.7.18-13ubuntu1.2+esm2

Timeline

References

Open in Interactive Console →