CVE-2019-5010: Null Pointer Dereference
A null pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities.
Other sources
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
— Ubuntu
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.7.2. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
References: https://bugs.python.org/issue35746
Upstream Patch: https://github.com/python/cpython/pull/11569
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/pythonto a version that resolves this vulnerability.Fixed in 0:2.7.5-86.el7 - Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 0:3.6.8-15.1.el8 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.9-2.el6 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.9-2.el7 - Upgrade
Upgrade
alpine/python2to a version that resolves this vulnerability.Fixed in 2.7.15-r3 - Upgrade
Upgrade
alpine/python2-tkinterto a version that resolves this vulnerability.Fixed in 2.7.15-r3 - Upgrade
Upgrade
alpine/python3to a version that resolves this vulnerability.Fixed in 3.6.8-r1 - Upgrade
Upgrade
alpine/python3-tkinterto a version that resolves this vulnerability.Fixed in 3.6.8-r1 - Compensating control
Enable SSL/TLS certificate validation and accept certificates only from trusted root certificate authorities when parsing certificates or initiating or accepting TLS connections.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-5010?
CVE-2019-5010 is a null pointer dereference vulnerability in the certificate parsing code in Python, which can cause a denial of service.
How does CVE-2019-5010 affect Python?
CVE-2019-5010 affects Python versions 2.7.5-86.el7, 3.6.8-15.1.el8, 3.6.9-2.el6, and 3.6.9-2.el7.
What is the severity of CVE-2019-5010?
CVE-2019-5010 has a severity rating of 7, which is considered high.
How can the CVE-2019-5010 vulnerability be exploited?
The CVE-2019-5010 vulnerability can be exploited by parsing specially crafted certificates, which triggers a null pointer dereference and causes a denial of service.
Is there a fix for CVE-2019-5010?
Yes, the vulnerability can be fixed by updating to the appropriate patched version of Python.