USN-4127-2: Python vulnerabilities
First published: Tue Sep 10 2019(Updated: )
USN-4127-1 fixed several vulnerabilities in Python. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-20406) It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852) Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160) Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2019-5010) It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947) Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blocklist meschanisms. (CVE-2019-9948)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/python2.7 | <2.7.6-8ubuntu0.6+esm2 | 2.7.6-8ubuntu0.6+esm2 |
| =14.04 | ||
| All of | ||
| ubuntu/python2.7-minimal | <2.7.6-8ubuntu0.6+esm2 | 2.7.6-8ubuntu0.6+esm2 |
| =14.04 | ||
| All of | ||
| ubuntu/python3.4 | <3.4.3-1ubuntu1~14.04.7+esm2 | 3.4.3-1ubuntu1~14.04.7+esm2 |
| =14.04 | ||
| All of | ||
| ubuntu/python3.4-minimal | <3.4.3-1ubuntu1~14.04.7+esm2 | 3.4.3-1ubuntu1~14.04.7+esm2 |
| =14.04 | ||
| All of | ||
| ubuntu/python2.7 | <2.7.3-0ubuntu3.14 | 2.7.3-0ubuntu3.14 |
| =12.04 | ||
| All of | ||
| ubuntu/python2.7-minimal | <2.7.3-0ubuntu3.14 | 2.7.3-0ubuntu3.14 |
| =12.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2018-20406
- https://ubuntu.com/security/CVE-2018-20852
- https://ubuntu.com/security/CVE-2019-10160
- https://ubuntu.com/security/CVE-2019-5010
- https://ubuntu.com/security/CVE-2019-9636
- https://ubuntu.com/security/CVE-2019-9740
- https://ubuntu.com/security/CVE-2019-9947
- https://ubuntu.com/security/CVE-2019-9948
- https://ubuntu.com/security/notices/USN-4127-1
- https://launchpad.net/ubuntu/+source/python2.7/2.7.6-8ubuntu0.6+esm2
- https://launchpad.net/ubuntu/+source/python3.4/3.4.3-1ubuntu1~14.04.7+esm2
- https://launchpad.net/ubuntu/+source/python2.7/2.7.3-0ubuntu3.14
- https://ubuntu.com/security/notices/USN-4127-2 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What vulnerabilities does USN-4127-2 fix?
USN-4127-2 fixes several vulnerabilities in Python, including CVE-2018-20406, CVE-2018-20852, and CVE-2019-10160.
What is the affected software for USN-4127-2?
The affected software for USN-4127-2 is Ubuntu 14.04 with Python versions 2.7.6-8ubuntu0.6+esm2 and 3.4.3-1ubuntu1~14.04.7+esm2.
How do I fix the vulnerabilities?
To fix the vulnerabilities, update Python to version 2.7.6-8ubuntu0.6+esm2 for Python 2.7 and 3.4.3-1ubuntu1~14.04.7+esm2 for Python 3.4.
What is the severity of the vulnerabilities fixed by USN-4127-2?
The severity of the vulnerabilities fixed by USN-4127-2 is not specified in the information provided.
Where can I find more information about the vulnerabilities fixed by USN-4127-2?
More information about the vulnerabilities fixed by USN-4127-2 can be found at the following references: [CVE-2018-20406](https://ubuntu.com/security/CVE-2018-20406), [CVE-2018-20852](https://ubuntu.com/security/CVE-2018-20852), [CVE-2019-10160](https://ubuntu.com/security/CVE-2019-10160).
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- agent/weakness
- collector/usn
- source/Ubuntu
- anchor-related/USN-4127-1
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/14.04
- version/ubuntu ubuntu/12.04