The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1064 advisory.

  - ** REJECT ** Various versions of Python do not properly restrict readline calls, which allows remote     attackers to cause a denial of service (memory consumption) via a long string, related to (1) httplib -     fixed in 2.7.4, 2.6.9, and 3.3.3; (2) ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; (3) imaplib - not yet fixed     in 2.7.x, fixed in 2.6.9, 3.3.3; (4) nntplib - fixed in 2.7.6, 2.6.9, 3.3.3; (5) poplib - not yet fixed in     2.7.x, fixed in 2.6.9, 3.3.3; and (6) smtplib - not yet fixed in 2.7.x, fixed in 2.6.9, not yet fixed in     3.3.x. NOTE: this was REJECTed because it is incompatible with CNT1 Independently Fixable in the CVE     Counting Decisions. (CVE-2013-1752)

  - Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7,     3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted     string. (CVE-2014-1912)

  - The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is     used for path separators, which allows remote attackers to read script source code or conduct directory     traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f     separator. (CVE-2014-4650)

  - Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain     sensitive information from process memory via a large size and offset in a buffer function.
    (CVE-2014-7185)

  - The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to     cause a denial of service (memory consumption) via a crafted HTTP request. (CVE-2013-1753)

  - Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson     before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index     value in the idx argument to the raw_decode function. (CVE-2014-4616)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python fixes the following issues :

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Python xmlrpclib module did not restrict the size of gzip-compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict the sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory. (CVE-2013-1752)

It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose the source code of the scripts in the cgi-bin directory. (CVE-2014-4650)

An integer overflow flaw was found in the way the buffer() function handled its offset and size arguments. An attacker able to control these arguments could use this flaw to disclose portions of the application memory or cause it to crash. (CVE-2014-7185)

A flaw was found in the way the json module handled negative index arguments passed to certain functions (such as raw_decode()). An attacker able to control the index value passed to one of the affected functions could possibly use this flaw to disclose portions of the application memory. (CVE-2014-4616)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

This update also fixes the following bugs :

  - Subprocesses used with the Eventlet library or regular     threads previously tried to close epoll file descriptors     twice, which led to an 'Invalid argument' error.
    Subprocesses have been fixed to close the file     descriptors only once.

  - When importing the readline module from a Python script,     Python no longer produces erroneous random characters on     stdout.

  - The cProfile utility has been fixed to print all values     that the '-s' option supports when this option is used     without a correct value.

  - The load_cert_chain() function now accepts 'None' as a     keyfile argument.

In addition, this update adds the following enhancements :

  - Security enhancements as described in PEP 466 have been     backported to the Python standard library, for example,     new features of the ssl module: Server Name Indication     (SNI) support, support for new TLSv1.x protocols, new     hash algorithms in the hashlib module, and many more.

  - Support for the ssl.PROTOCOL_TLSv1_2 protocol has been     added to the ssl library.

  - The ssl.SSLSocket.version() method is now available to     access information about the version of the SSL protocol     used in a connection.

Updated python packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Python is an interpreted, interactive, object-oriented programming language often compared to Tcl, Perl, Scheme, or Java. Python includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems (X11, Motif, Tk, Mac and MFC).

It was discovered that the Python xmlrpclib module did not restrict the size of gzip-compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict the sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory. (CVE-2013-1752)

It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose the source code of the scripts in the cgi-bin directory. (CVE-2014-4650)

An integer overflow flaw was found in the way the buffer() function handled its offset and size arguments. An attacker able to control these arguments could use this flaw to disclose portions of the application memory or cause it to crash. (CVE-2014-7185)

A flaw was found in the way the json module handled negative index arguments passed to certain functions (such as raw_decode()). An attacker able to control the index value passed to one of the affected functions could possibly use this flaw to disclose portions of the application memory. (CVE-2014-4616)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

Note: The Python standard library was updated to make it possible to enable certificate verification by default. However, for backwards compatibility, verification remains disabled by default. Future updates may change this default. Refer to the Knowledgebase article 2039753 linked to in the References section for further details about this change. (BZ#1219108)

This update also fixes the following bugs :

* Subprocesses used with the Eventlet library or regular threads previously tried to close epoll file descriptors twice, which led to an 'Invalid argument' error. Subprocesses have been fixed to close the file descriptors only once. (BZ#1103452)

* When importing the readline module from a Python script, Python no longer produces erroneous random characters on stdout. (BZ#1189301)

* The cProfile utility has been fixed to print all values that the '-s' option supports when this option is used without a correct value.
(BZ#1237107)

* The load_cert_chain() function now accepts 'None' as a keyfile argument. (BZ#1250611)

In addition, this update adds the following enhancements :

* Security enhancements as described in PEP 466 have been backported to the Python standard library, for example, new features of the ssl module: Server Name Indication (SNI) support, support for new TLSv1.x protocols, new hash algorithms in the hashlib module, and many more.
(BZ#1111461)

* Support for the ssl.PROTOCOL_TLSv1_2 protocol has been added to the ssl library. (BZ#1192015)

* The ssl.SSLSocket.version() method is now available to access information about the version of the SSL protocol used in a connection. (BZ#1259421)

All python users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

From Red Hat Security Advisory 2015:2101 :

Updated python packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Python is an interpreted, interactive, object-oriented programming language often compared to Tcl, Perl, Scheme, or Java. Python includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems (X11, Motif, Tk, Mac and MFC).

It was discovered that the Python xmlrpclib module did not restrict the size of gzip-compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict the sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory. (CVE-2013-1752)

It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose the source code of the scripts in the cgi-bin directory. (CVE-2014-4650)

An integer overflow flaw was found in the way the buffer() function handled its offset and size arguments. An attacker able to control these arguments could use this flaw to disclose portions of the application memory or cause it to crash. (CVE-2014-7185)

A flaw was found in the way the json module handled negative index arguments passed to certain functions (such as raw_decode()). An attacker able to control the index value passed to one of the affected functions could possibly use this flaw to disclose portions of the application memory. (CVE-2014-4616)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

Note: The Python standard library was updated to make it possible to enable certificate verification by default. However, for backwards compatibility, verification remains disabled by default. Future updates may change this default. Refer to the Knowledgebase article 2039753 linked to in the References section for further details about this change. (BZ#1219108)

This update also fixes the following bugs :

* Subprocesses used with the Eventlet library or regular threads previously tried to close epoll file descriptors twice, which led to an 'Invalid argument' error. Subprocesses have been fixed to close the file descriptors only once. (BZ#1103452)

* When importing the readline module from a Python script, Python no longer produces erroneous random characters on stdout. (BZ#1189301)

* The cProfile utility has been fixed to print all values that the '-s' option supports when this option is used without a correct value.
(BZ#1237107)

* The load_cert_chain() function now accepts 'None' as a keyfile argument. (BZ#1250611)

In addition, this update adds the following enhancements :

* Security enhancements as described in PEP 466 have been backported to the Python standard library, for example, new features of the ssl module: Server Name Indication (SNI) support, support for new TLSv1.x protocols, new hash algorithms in the hashlib module, and many more.
(BZ#1111461)

* Support for the ssl.PROTOCOL_TLSv1_2 protocol has been added to the ssl library. (BZ#1192015)

* The ssl.SSLSocket.version() method is now available to access information about the version of the SSL protocol used in a connection. (BZ#1259421)

All python users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2101 advisory.

  - python: multiple unbound readline() DoS flaws in python stdlib (CVE-2013-1752)

  - python: XMLRPC library unrestricted decompression of HTTP responses using gzip enconding (CVE-2013-1753)

  - python: missing boundary check in JSON module (CVE-2014-4616)

  - python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs (CVE-2014-4650)

  - python: buffer() integer overflow leading to out of bounds read (CVE-2014-7185)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to python 2.7.9 fixes the following issues :

  - python-2.7-libffi-aarch64.patch: Fix argument passing in     libffi for aarch64

From the version update to 2.7.9 :

  - contains full backport of ssl module from Python 3.4     (PEP466)

  - HTTPS certificate validation enabled by default (PEP476)

  - SSLv3 disabled by default (bnc#901715)

  - backported ensurepip module (PEP477)

  - fixes several missing CVEs from last release:
    CVE-2013-1752, CVE-2013-1753

  - dropped upstreamed patches: python-2.7.6-poplib.patch,     smtplib_maxline-2.7.patch, xmlrpc_gzip_27.patch

  - dropped patch python-2.7.3-ssl_ca_path.patch because we     don't need it with ssl module from Python 3

  - libffi was upgraded upstream, seems to contain our     changes, so dropping libffi-ppc64le.diff as well

  - python-2.7-urllib2-localnet-ssl.patch - properly remove     unconditional 'import ssl' from test_urllib2_localnet     that caused it to fail without ssl

  - skip test_thread in qemu_linux_user mode

From the version update to 2.7.8 :

  - fixes CVE-2014-4650 directory traversal in CGIHTTPServer

  - fixes CVE-2014-7185 (bnc#898572) potential buffer     overflow in buffer()

Also the DH parameters were increased to 2048 bit to fix logjam security issue (bsc#935856)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that multiple Python protocol libraries incorrectly limited certain data when connecting to servers. A malicious ftp, http, imap, nntp, pop or smtp server could use this issue to cause a denial of service. (CVE-2013-1752)

It was discovered that the Python xmlrpc library did not limit unpacking gzip-compressed HTTP bodies. A malicious server could use this issue to cause a denial of service. (CVE-2013-1753)

It was discovered that the Python json module incorrectly handled a certain argument. An attacker could possibly use this issue to read arbitrary memory and expose sensitive information. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-4616)

It was discovered that the Python CGIHTTPServer incorrectly handled URL-encoded path separators in URLs. A remote attacker could use this issue to expose sensitive information, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
(CVE-2014-4650)

It was discovered that Python incorrectly handled sizes and offsets in buffer functions. An attacker could possibly use this issue to read arbitrary memory and obtain sensitive information. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-7185).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory.(CVE-2013-1752)

It was discovered that the Python xmlrpclib did not restrict the size of a gzip compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data.(CVE-2014-9365)

Updated python packages fix security vulnerabilities :

A vulnerability was reported in Python's socket module, due to a boundary error within the sock_recvfrom_into() function, which could be exploited to cause a buffer overflow. This could be used to crash a Python application that uses the socket.recvfrom_info() function or, possibly, execute arbitrary code with the permissions of the user running vulnerable Python code (CVE-2014-1912).

This updates the python package to version 2.7.6, which fixes several other bugs, including denial of service flaws due to unbound readline() calls in the ftplib and nntplib modules (CVE-2013-1752).

Denial of service flaws due to unbound readline() calls in the imaplib, poplib, and smtplib modules (CVE-2013-1752).

A gzip bomb and unbound read denial of service flaw in python XMLRPC library (CVE-2013-1753).

Python are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616).

The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root (CVE-2014-4650).

Python before 2.7.8 is vulnerable to an integer overflow in the buffer type (CVE-2014-7185).

When Python's standard library HTTP clients (httplib, urllib, urllib2, xmlrpclib) are used to access resources with HTTPS, by default the certificate is not checked against any trust store, nor is the hostname in the certificate checked against the requested host. It was possible to configure a trust root to be checked against, however there were no faculties for hostname checking (CVE-2014-9365).

The python-pip and tix packages was added due to missing build dependencies.

Python was updated to 3.3.5 fixing bugs and security issues :

  - bugfix-only release, closes several security bugs

  - CVE-2013-1752 (bnc#856836) - DoS flaws with unbounded     reads from network

  - disable SSLv2 by default

  - DoS on maliciously crafted zip files (CVE-2013-7338,     bnc#869222)

  - CGIHttpRequestHandler directory traversal

  - gzip decompression bomb in xmlrpc client (CVE-2013-1753,     bnc#856835) xmlrpc_gzip_33.patch

  - potential buffer overflow in recvfrom_into     (CVE-2014-1912, bnc#863741)

  - hundreds of non-security-related bugfixes

Python was updated to 2.7.6 to fix bugs and security issues :

  - bugfix-only release

  - SSL-related fixes

  - upstream fix for CVE-2013-4238

  - upstream fixes for CVE-2013-1752

  - added patches for CVE-2013-1752 (bnc#856836) issues that     are missing in 2.7.6: python-2.7.6-imaplib.patch     python-2.7.6-poplib.patch smtplib_maxline-2.7.patch

  - CVE-2013-1753 (bnc#856835) gzip decompression bomb in     xmlrpc client: xmlrpc_gzip_27.patch

  - python-2.7.6-bdist-rpm.patch: fix broken 'setup.py     bdist_rpm' command (bnc#857470, issue18045)

  - multilib patch: add '~/.local/lib64' paths to search     path (bnc#637176)

  - CVE-2014-1912-recvfrom_into.patch: fix potential buffer     overflow in socket.recvfrom_into (CVE-2014-1912,     bnc#863741)

  - Add Obsoletes/Provides for python-ctypes.

  - reintroduce audioop.so as the problems with it seem to     be fixed (bnc#831442)

Updated python package fixes security vulnerabilities :

Denial of service flaws due to unbound readline() calls in the imaplib, poplib, and smtplib modules (CVE-2013-1752).

A gzip bomb and unbound read denial of service flaw in python XMLRPC library (CVE-2013-1753).

ID	Name	Product	Family	Severity
181042	Oracle Linux 6 / 7 : python27 (ELSA-2015-1064)	Nessus	Oracle Linux Local Security Checks	critical
133259	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	critical
87570	Scientific Linux Security Update : python on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	critical
87129	CentOS 7 : python (CESA-2015:2101)	Nessus	CentOS Local Security Checks	critical
87020	Oracle Linux 7 : python (ELSA-2015-2101)	Nessus	Oracle Linux Local Security Checks	critical
86968	RHEL 7 : python (RHSA-2015:2101)	Nessus	Red Hat Local Security Checks	critical
85250	SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2015:1344-1)	Nessus	SuSE Local Security Checks	critical
84428	Ubuntu 14.04 LTS : Python vulnerabilities (USN-2653-1)	Nessus	Ubuntu Local Security Checks	critical
84369	Amazon Linux AMI : python27 (ALAS-2015-552)	Nessus	Amazon Linux Local Security Checks	high
82328	Mandriva Linux Security Advisory : python (MDVSA-2015:075)	Nessus	Mandriva Local Security Checks	high
75315	openSUSE Security Update : python3 (openSUSE-SU-2014:0498-1)	Nessus	SuSE Local Security Checks	high
75294	openSUSE Security Update : python (openSUSE-SU-2014:0380-1)	Nessus	SuSE Local Security Checks	high
73449	Mandriva Linux Security Advisory : python (MDVSA-2014:074)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2013-1753

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

medium