REDHAT-BUG-632200: Race Condition
First published: Thu Sep 09 2010(Updated: )
A race condition was found in the way Python's SMTP proxy module (smtpd.py) processed retrieving of remote IP address the socket was connected to (the other end could close the connection sooner before the requester could get the peername). A remote, unauthenticated user could use this flaw to cause the running python SMTP instance to terminate with uncaught exception by issuing sequence of connection requests within short time interval. References: [1] <a href="http://bugs.python.org/issue9129">http://bugs.python.org/issue9129</a> Upstream patch: [2] <a href="http://svn.python.org/view?view=rev&revision=84289">http://svn.python.org/view?view=rev&revision=84289</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Python 2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.python.org/issue9129
- http://svn.python.org/view?view=rev&revision=84289
- http://www.openwall.com/lists/oss-security/2010/09/09/6
- http://svn.python.org/view?rev=87123&view=rev
- https://rhn.redhat.com/errata/RHSA-2011-0492.html
- https://rhn.redhat.com/errata/RHSA-2011-0491.html
- https://rhn.redhat.com/errata/RHSA-2011-0554.html
- https://bugzilla.redhat.com/show_bug.cgi?id=632200
Frequently Asked Questions
What is the severity of REDHAT-BUG-632200?
The severity of REDHAT-BUG-632200 is classified as a medium risk due to the potential for a remote, unauthenticated user to exploit the race condition.
How do I fix REDHAT-BUG-632200?
To fix REDHAT-BUG-632200, ensure you are running the latest version of Python that contains the patch for the race condition.
What versions of Python are affected by REDHAT-BUG-632200?
REDHAT-BUG-632200 affects specific versions of Python that utilize the SMTP proxy module; verify with your installed version's documentation for vulnerabilities.
What is the nature of the vulnerability in REDHAT-BUG-632200?
The nature of the vulnerability in REDHAT-BUG-632200 is a race condition in the SMTP proxy module that can allow a remote user to exploit connection handling.
Can REDHAT-BUG-632200 be exploited remotely?
Yes, REDHAT-BUG-632200 can be exploited by a remote, unauthenticated user if the vulnerable Python version is in use.
- agent/references
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-3493
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/python
- canonical/python 2.7