Detections
Analytics

Amazon Linux AMI : python35 (ALAS-2019-1243)

critical Nessus Plugin ID 127071

Language:

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

An issue was discovered in urllib2 in Python 2.x and urllib in Python 3.x. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.
(CVE-2019-9740 , CVE-2019-9947)

Python 2.7.x and 3.x are affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are:
urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. (CVE-2019-9636)

Solution

Run 'yum update python35' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2019-1243.html

Plugin Details

Severity: Critical

ID: 127071

File Name: ala_ALAS-2019-1243.nasl

Version: 1.2

Type: local

Agent: unix

Published: 7/26/2019

Updated: 1/6/2020

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:python35, p-cpe:/a:amazon:linux:python35-debuginfo, p-cpe:/a:amazon:linux:python35-devel, p-cpe:/a:amazon:linux:python35-libs, p-cpe:/a:amazon:linux:python35-test, p-cpe:/a:amazon:linux:python35-tools, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 7/25/2019

Vulnerability Publication Date: 3/8/2019

Reference Information

CVE: CVE-2019-9636, CVE-2019-9740, CVE-2019-9947

ALAS: 2019-1243