USN-4127-1

Dashboard / Vulnerabilities / USN-4127-1

USN-4127-1

Summary: python2.7, python3.5, python3.6, python3.7 vulnerabilities

Details: It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-20406) It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852) Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160) Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010) It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947) Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blocklist meschanisms. (CVE-2019-9948)

References: https://ubuntu.com/security/notices/USN-4127-1, https://ubuntu.com/security/CVE-2018-20406, https://ubuntu.com/security/CVE-2018-20852, https://ubuntu.com/security/CVE-2019-5010, https://ubuntu.com/security/CVE-2019-9636, https://ubuntu.com/security/CVE-2019-9740, https://ubuntu.com/security/CVE-2019-9947, https://ubuntu.com/security/CVE-2019-9948, https://ubuntu.com/security/CVE-2019-10160