First published: Tue Jan 15 2019(Updated: )
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
Credit: talos-cna@cisco.com talos-cna@cisco.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/python | <0:2.7.5-86.el7 | 0:2.7.5-86.el7 |
redhat/python3 | <0:3.6.8-15.1.el8 | 0:3.6.8-15.1.el8 |
redhat/rh-python36-python | <0:3.6.9-2.el6 | 0:3.6.9-2.el6 |
redhat/rh-python36-python | <0:3.6.9-2.el7 | 0:3.6.9-2.el7 |
Python Python | >=2.7.0<2.7.16 | |
Python Python | >=3.4.0<3.4.10 | |
Python Python | >=3.5.0<3.5.7 | |
Python Python | >=3.6.0<3.6.9 | |
Python Python | >=3.7.0<3.7.3 | |
openSUSE Leap | =15.1 | |
Debian Debian Linux | =9.0 | |
Redhat Enterprise Linux | =8.0 | |
Redhat Enterprise Linux Eus | =8.1 | |
Redhat Enterprise Linux Eus | =8.2 | |
Redhat Enterprise Linux Eus | =8.4 | |
Redhat Enterprise Linux Eus | =8.6 | |
Redhat Enterprise Linux Server Aus | =8.2 | |
Redhat Enterprise Linux Server Aus | =8.4 | |
Redhat Enterprise Linux Server Aus | =8.6 | |
Redhat Enterprise Linux Server Tus | =8.2 | |
Redhat Enterprise Linux Server Tus | =8.4 | |
Redhat Enterprise Linux Server Tus | =8.6 | |
ubuntu/python2.7 | <2.7.15-4ubuntu4~18.04.1 | 2.7.15-4ubuntu4~18.04.1 |
ubuntu/python2.7 | <2.7.16-2~18.10 | 2.7.16-2~18.10 |
ubuntu/python2.7 | <2.7.16 | 2.7.16 |
ubuntu/python2.7 | <2.7.12-1ubuntu0~16.04.8 | 2.7.12-1ubuntu0~16.04.8 |
ubuntu/python3.4 | <3.4.3-1ubuntu1~14.04.7+ | 3.4.3-1ubuntu1~14.04.7+ |
ubuntu/python3.5 | <3.5.2-2ubuntu0~16.04.8 | 3.5.2-2ubuntu0~16.04.8 |
ubuntu/python3.6 | <3.6.8-1~18.04.2 | 3.6.8-1~18.04.2 |
ubuntu/python3.7 | <3.7.2-2 | 3.7.2-2 |
debian/python2.7 | 2.7.16-2+deb10u1 2.7.16-2+deb10u4 2.7.18-8+deb11u1 | |
debian/python3.7 | 3.7.3-2+deb10u3 3.7.3-2+deb10u7 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2019-5010 is a null pointer dereference vulnerability in the certificate parsing code in Python, which can cause a denial of service.
CVE-2019-5010 affects Python versions 2.7.5-86.el7, 3.6.8-15.1.el8, 3.6.9-2.el6, and 3.6.9-2.el7.
CVE-2019-5010 has a severity rating of 7, which is considered high.
The CVE-2019-5010 vulnerability can be exploited by parsing specially crafted certificates, which triggers a null pointer dereference and causes a denial of service.
Yes, the vulnerability can be fixed by updating to the appropriate patched version of Python.