python2.7, python3.5, python3.6, python3.7 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
Several security issues were fixed in Python.
Software Description
It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010)
It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947)
Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blacklist meschanisms. (CVE-2019-9948)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 19.04
python2.7 - 2.7.16-2ubuntu0.1
python2.7-minimal - 2.7.16-2ubuntu0.1
python3.7 - 3.7.3-2ubuntu0.1
python3.7-minimal - 3.7.3-2ubuntu0.1
Ubuntu 18.04 LTS
python2.7 - 2.7.15-4ubuntu4~18.04.1
python2.7-minimal - 2.7.15-4ubuntu4~18.04.1
python3.6 - 3.6.8-1~18.04.2
python3.6-minimal - 3.6.8-1~18.04.2
Ubuntu 16.04 LTS
python2.7 - 2.7.12-1ubuntu0~16.04.8
python2.7-minimal - 2.7.12-1ubuntu0~16.04.8
python3.5 - 3.5.2-2ubuntu0~16.04.8
python3.5-minimal - 3.5.2-2ubuntu0~16.04.8
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
References
Continue reading...
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Several security issues were fixed in Python.
Software Description
- python2.7 - An interactive high-level object-oriented language
- python3.7 - An interactive high-level object-oriented language
- python3.6 - An interactive high-level object-oriented language
- python3.5 - An interactive high-level object-oriented language
It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010)
It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947)
Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blacklist meschanisms. (CVE-2019-9948)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 19.04
python2.7 - 2.7.16-2ubuntu0.1
python2.7-minimal - 2.7.16-2ubuntu0.1
python3.7 - 3.7.3-2ubuntu0.1
python3.7-minimal - 3.7.3-2ubuntu0.1
Ubuntu 18.04 LTS
python2.7 - 2.7.15-4ubuntu4~18.04.1
python2.7-minimal - 2.7.15-4ubuntu4~18.04.1
python3.6 - 3.6.8-1~18.04.2
python3.6-minimal - 3.6.8-1~18.04.2
Ubuntu 16.04 LTS
python2.7 - 2.7.12-1ubuntu0~16.04.8
python2.7-minimal - 2.7.12-1ubuntu0~16.04.8
python3.5 - 3.5.2-2ubuntu0~16.04.8
python3.5-minimal - 3.5.2-2ubuntu0~16.04.8
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
References
- CVE-2018-20406
- CVE-2018-20852
- CVE-2019-10160
- CVE-2019-5010
- CVE-2019-9636
- CVE-2019-9740
- CVE-2019-9947
- CVE-2019-9948
Continue reading...
