Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions     prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable     however this has not been confirmed. The vulnerability lies when multiply threads are handling large     amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-     Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without     knowing how much to write. So when a large amount of data is being processed, it is very easy to cause     memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free,     Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a     security vulnerability due to the fact that the attacker must be able to run code, however in some     situations, such as function as a service, this vulnerability can potentially be used by an attacker to     violate a trust boundary, as such the DWF feels this issue deserves a CVE. (CVE-2018-1000030)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the python2 package has been released.

This update for python fixes the following issues :

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Python is an interpreted, interactive, object-oriented     programming language, which includes modules, classes,     exceptions, very high level dynamic data types and     dynamic typing. Python supports interfaces to many     system calls and libraries, as well as to various     windowing systems.Security Fix(es):A security     regression of CVE-2019-9636 was discovered in python,     since commit d537ab0ff9767ef024f26246899728f0116b1ec3,     which still allows an attacker to exploit CVE-2019-9636     by abusing the user and password parts of a URL. When     an application parses user-supplied URLs to store     cookies, authentication credentials, or other kind of     information, it is possible for an attacker to provide     specially crafted URLs to make the application locate     host-related information (e.g. cookies, authentication     data) and send them to a different host than where it     should, unlike if the URLs had been correctly parsed.
    The result of an attack may vary based on the     application.(CVE-2019-10160)urllib in Python 2.x     through 2.7.16 supports the local_file: scheme, which     makes it easier for remote attackers to bypass     protection mechanisms that blacklist file: URIs, as     demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd')     call.(CVE-2019-9948)Python's elementtree C accelerator     failed to initialise Expat's hash salt during     initialization. This could make it easy to conduct     denial of service attacks against Expat by constructing     an XML document that would cause pathological hash     collisions in Expat's internal data structures,     consuming large amounts CPU and     RAM.(CVE-2018-14647)python 2.7.14 is vulnerable to a     Heap-Buffer-Overflow as well as a Heap-Use-After-Free.
    Python versions prior to 2.7.14 may also be vulnerable     and it appears that Python 2.7.17 and prior may also be     vulnerable however this has not been confirmed. The     vulnerability lies when multiply threads are handling     large amounts of data. In both cases there is     essentially a race condition that occurs. For the     Heap-Buffer-Overflow, Thread 2 is creating the size for     a buffer, but Thread1 is already writing to the buffer     without knowing how much to write. So when a large     amount of data is being processed, it is very easy to     cause memory corruption using a Heap-Buffer-Overflow.
    As for the Use-After-Free,     Thread3-i1/4zMalloc-i1/4zThread1-i1/4zFree's-i1/4zThread2-Re-us     es-Free'd Memory. The PSRT has stated that this is not     a security vulnerability due to the fact that the     attacker must be able to run code, however in some     situations, such as function as a service, this     vulnerability can potentially be used by an attacker to     violate a trust boundary, as such the DWF feels this     issue deserves a CVE.(CVE-2018-1000030)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3817-1 advisory.

    It was discovered that Python incorrectly handled large amounts of data. A remote attacker could use this     issue to cause Python to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2018-1000030)

    It was discovered that Python incorrectly handled running external commands in the shutil module. A remote     attacker could use this issue to cause Python to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2018-1000802)

    It was discovered that Python incorrectly used regular expressions vulnerable to catastrophic     backtracking. A remote attacker could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2018-1060, CVE-2018-1061)

    It was discovered that Python failed to initialize Expat's hash salt. A remote attacker could possibly use     this issue to cause hash collisions, leading to a denial of service. (CVE-2018-14647)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201811-02 (Python: Buffer overflow)

    A buffer overflow vulnerability have been discovered in Python. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, in special situations such as function as a service,       could violate a trust boundary and cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for python fixes the following issues :

Security issues fixed :

  - CVE-2017-1000158: Fixed integer overflows in     PyString_DecodeEscape that could have resulted in     heap-based buffer overflow attacks and possible     arbitrary code execution (bsc#1068664).

  - CVE-2018-1000030: Fixed crash inside the Python     interpreter when multiple threads used the same I/O     stream concurrently (bsc#1079300).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for python fixes the following issues: Security issues fixed :

  - CVE-2017-1000158: Fixed integer overflows in     PyString_DecodeEscape that could have resulted in     heap-based buffer overflow attacks and possible     arbitrary code execution (bsc#1068664).

  - CVE-2018-1000030: Fixed crash inside the Python     interpreter when multiple threads used the same I/O     stream concurrently (bsc#1079300).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - python 2.7.14 is vulnerable to a Heap-Buffer-Overflow     as well as a Heap-Use-After-Free. Python versions prior     to 2.7.14 may also be vulnerable and it appears that     Python 2.7.17 and prior may also be vulnerable however     this has not been confirmed. The vulnerability lies     when multiply threads are handling large amounts of     data. In both cases there is essentially a race     condition that occurs. For the Heap-Buffer-Overflow,     Thread 2 is creating the size for a buffer, but Thread1     is already writing to the buffer without knowing how     much to write. So when a large amount of data is being     processed, it is very easy to cause memory corruption     using a Heap-Buffer-Overflow. As for the     Use-After-Free,     Thread3-i1/4zMalloc-i1/4zThread1-i1/4zFree's-i1/4zThread2-Re-us     es-Free'd Memory. The PSRT has stated that this is not     a security vulnerability due to the fact that the     attacker must be able to run code, however in some     situations, such as function as a service, this     vulnerability can potentially be used by an attacker to     violate a trust boundary, as such the DWF feels this     issue deserves a CVE.(CVE-2018-1000030)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
221660	Linux Distros Unpatched Vulnerability : CVE-2018-1000030	Nessus	Misc.	Local	low
203060	Photon OS 2.0: Python2 PHSA-2018-2.0-0037	Nessus	PhotonOS Local Security Checks	Local	low
133259	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	Local	critical
129212	EulerOS 2.0 SP3 : python (EulerOS-SA-2019-2019)	Nessus	Huawei Local Security Checks	Local	critical
121820	Photon OS 1.0: Python2 PHSA-2018-1.0-0125	Nessus	PhotonOS Local Security Checks	Local	low
118954	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-3817-1)	Nessus	Ubuntu Local Security Checks	Local	critical
118846	GLSA-201811-02 : Python: Buffer overflow	Nessus	Gentoo Local Security Checks	Local	low
110069	openSUSE Security Update : python (openSUSE-2018-511)	Nessus	SuSE Local Security Checks	Local	critical
110037	SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2018:1372-1)	Nessus	SuSE Local Security Checks	Local	critical
109476	EulerOS 2.0 SP1 : python (EulerOS-SA-2018-1078)	Nessus	Huawei Local Security Checks	Local	low

Detections

Analytics

CVE-2018-1000030

low

Tenable Plugins

low

low

critical

critical

low

critical

low

critical

critical

low