DSA-4306: -1 python2.7 -- security update

Published Sep 27, 2018

Updated

Multiple security issues were discovered in Python: ElementTree failed to initialise Expat's hash salt, two denial of service issues were found in difflib and poplib and the shutil module was affected by a command injection vulnerability.

Affected Software

2 affected components

debian/python2.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade python2.7 to a version that resolves this vulnerability.
Patch DSA-4306-1

Event History

Sep 27, 2018

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which Python components are implicated by these issues?

The issues affect ElementTree through Expat hash-salt initialization, difflib, poplib, and shutil.

What kinds of impact are identified in this update?

The update addresses two denial-of-service issues in difflib and poplib, a command injection vulnerability in shutil, and failure to initialize Expat's hash salt in ElementTree.

Which CVEs are associated with the security update?

The referenced CVEs are CVE-2018-1060, CVE-2018-1061, and CVE-2018-14647.