Security fix for CVE-2019-5010

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

Security issues fixed :

CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191).

CVE-2018-14647: Fixed a denial-of-service vulnerability in Expat (bsc#1109847).

Non-security issue fixed: Fixed a bug where PyWeakReference struct was not initialized correctly leading to a crash (bsc#1073748).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New python packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities.(CVE-2019-5010)

A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities. (CVE-2019-5010)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Python's elementtree C accelerator failed to initialise     Expat's hash salt during initialization. This could     make it easy to conduct denial of service attacks     against Expat by constructing an XML document that     would cause pathological hash collisions in Expat's     internal data structures, consuming large amounts CPU     and RAM. Python 3.8, 3.7, 3.6, 3.5, 3.4, 2.7 are     believed to be vulnerable.(CVE-2018-14647)

  - An exploitable denial-of-service vulnerability exists     in the X509 certificate parser of Python.org Python     2.7.11 / 3.6.6. A specially crafted X509 certificate     can cause a NULL pointer dereference, resulting in a     denial of service. An attacker can initiate or accept     TLS connections using crafted certificates to trigger     this vulnerability.(CVE-2019-5010)

  - urllib in Python 2.x through 2.7.16 supports the     local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that     blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd')     call.(CVE-2019-9948)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities. (CVE-2019-5010)

Python 2.7.16 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is:
Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. (CVE-2019-9636)

A flaw was found in the way catastrophic backtracking was implemented in python's pop3lib's apop() method. An attacker could use this flaw to cause denial of service. (CVE-2018-1060)

Modules/_pickle.c in Python 2.7.16 has an integer overflow via a large LONG_BINPUT value that is mishandled during a 'resize to twice the size' attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. (CVE-2018-20406)

A flaw was found in the way catastrophic backtracking was implemented in python's difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service. (CVE-2018-1061)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2030 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)

    * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)

    * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

    * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

    * python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for python is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es) :

* python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)

* python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)

* python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

* python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

* python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

This update for python3 fixes the following issues :

Fixed CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support calls eval() on content retrieved via HTTP.

Change setuptools and pip version numbers according to new wheels

Handful of changes to make python36 compatible with SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738)

add triplets for mips-r6 and riscv

RISC-V needs CTYPES_PASS_BY_REF_HACK

Update to 3.6.12 (bsc#1179193)

Ensure python3.dll is loaded from correct locations when Python is embedded

The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address).

Prevent http header injection by rejecting control characters in http.client.putrequest(&acirc;&#128;&brvbar;).

Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing.

Avoid infinite loop when reading specially crafted TAR files using the tarfile module

This release also fixes CVE-2020-26116 (bsc#1177211) and CVE-2019-20907 (bsc#1174091).

Update to 3.6.11 :

Disallow CR or LF in email.headerregistry. Address arguments to guard against header injection attacks.

Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised. (bsc#1155094)

CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This DLA fixes a a problem parsing x509 certificates, an pickle integer overflow, and some other minor issues :

CVE-2016-0772

The smtplib library in CPython does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a 'StartTLS stripping attack.'

CVE-2016-5636

Integer overflow in the get_data function in zipimport.c in CPython allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

CVE-2016-5699

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

CVE-2018-20406

Modules/_pickle.c has an integer overflow via a large LONG_BINPUT value that is mishandled during a 'resize to twice the size' attempt.
This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data.

CVE-2019-5010

NULL pointer dereference using a specially crafted X509 certificate.

For Debian 8 'Jessie', these problems have been fixed in version 3.4.2-1+deb8u2.

We recommend that you upgrade your python3.4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 5.11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.2 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
121579	Fedora 29 : python36 (2019-7eb6d3b8ea)	Nessus	Fedora Local Security Checks	2/5/2019	6/24/2024	high
122446	SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2019:0482-1)	Nessus	SuSE Local Security Checks	2/26/2019	6/18/2024	high
122577	Slackware 14.0 / 14.1 / 14.2 / current : python (SSA:2019-062-01)	Nessus	Slackware Local Security Checks	3/4/2019	6/17/2024	high
122675	Amazon Linux 2 : python3 (ALAS-2019-1169)	Nessus	Amazon Linux Local Security Checks	3/8/2019	6/14/2024	high
123082	Amazon Linux AMI : python27 / python34,python35,python36 (ALAS-2019-1169)	Nessus	Amazon Linux Local Security Checks	3/26/2019	6/12/2024	high
124624	EulerOS 2.0 SP5 : python (EulerOS-SA-2019-1338)	Nessus	Huawei Local Security Checks	5/6/2019	5/28/2024	critical
126383	Amazon Linux 2 : python (ALAS-2019-1230)	Nessus	Amazon Linux Local Security Checks	7/2/2019	5/13/2024	critical
127651	RHEL 7 : python (RHSA-2019:2030)	Nessus	Red Hat Local Security Checks	8/12/2019	11/6/2024	critical
128333	CentOS 7 : python (CESA-2019:2030)	Nessus	CentOS Local Security Checks	8/30/2019	4/30/2024	critical
144586	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:3930-1)	Nessus	SuSE Local Security Checks	12/24/2020	1/31/2024	critical
122036	Debian DLA-1663-1 : python3.4 security update	Nessus	Debian Local Security Checks	2/8/2019	6/21/2024	critical
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	9/1/2022	7/22/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

critical

critical

critical

critical

critical

critical