CVE-2019-5010: Null Pointer Dereference
A null pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities.
Other sources
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.7.2. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
References: https://bugs.python.org/issue35746
Upstream Patch: https://github.com/python/cpython/pull/11569
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-5010?
CVE-2019-5010 is a null pointer dereference vulnerability in the certificate parsing code in Python, which can cause a denial of service.
How does CVE-2019-5010 affect Python?
CVE-2019-5010 affects Python versions 2.7.5-86.el7, 3.6.8-15.1.el8, 3.6.9-2.el6, and 3.6.9-2.el7.
What is the severity of CVE-2019-5010?
CVE-2019-5010 has a severity rating of 7, which is considered high.
How can the CVE-2019-5010 vulnerability be exploited?
The CVE-2019-5010 vulnerability can be exploited by parsing specially crafted certificates, which triggers a null pointer dereference and causes a denial of service.
Is there a fix for CVE-2019-5010?
Yes, the vulnerability can be fixed by updating to the appropriate patched version of Python.