DSA-4307: -1 python3.5 -- security update

Published Sep 28, 2018

Updated

Multiple security issues were discovered in Python: ElementTree failed to initialise Expat's hash salt, two denial of service issues were found in difflib and poplib and a buffer overflow in PyStringDecodeEscape.

Affected Software

2 affected components

debian/python3.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade python3.5 to a version that resolves this vulnerability.
Patch DSA-4307-1

Event History

Sep 28, 2018

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2017-1000158
CVE-2018-1060
CVE-2018-1061
CVE-2018-14647

Frequently Asked Questions

Which components and failure modes are involved?

The update addresses ElementTree failing to initialize Expat's hash salt, denial-of-service issues in difflib and poplib, and a buffer overflow in PyString_DecodeEscape.

Which CVEs are associated with this update?

The referenced CVEs are CVE-2017-1000158, CVE-2018-1060, and CVE-2018-1061.