Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 2.7/3.4 may crash or expose data
published 7 years ago
Summary
The Python 2.7 and Python 3.4 packages in Ubuntu 12.04 and 14.04 extended support can mishandle certain files, cookies, URLs and certificates. This can lead to crashes, denial of service, or accidental disclosure of information. Apply the latest security update from Ubuntu to fix these issues.
What to do
- Update canonical python2.7 to version 2.7.6-8ubuntu0.6+esm2.
- Update canonical python3.4 to version 3.4.3-1ubuntu1~14.04.7+esm2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | python2.7 |
< 2.7.6-8ubuntu0.6+esm2 Fix: upgrade to 2.7.6-8ubuntu0.6+esm2
|
| Ubuntu:Pro:14.04:LTS | canonical | python3.4 |
< 3.4.3-1ubuntu1~14.04.7+esm2 Fix: upgrade to 3.4.3-1ubuntu1~14.04.7+esm2
|
Original advisory text
python2.7, python3.4 vulnerabilities
USN-4127-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain pickle files. An
attacker could possibly use this issue to consume memory, leading to a
denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when
handling cookies. An attacker could possibly trick Python into sending
cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly
handled Unicode encoding during NFKC normalization. An attacker could
possibly use this issue to obtain sensitive information. (CVE-2019-9636,
CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled
parsing certain X509 certificates. An attacker could possibly use this
issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 ESM. (CVE-2019-5010)
It was discovered that Python incorrectly handled certain urls. A remote
attacker could possibly use this issue to perform CRLF injection attacks.
(CVE-2019-9740, CVE-2019-9947)
Sihoon Lee discovered that Python incorrectly handled the local_file:
scheme. A remote attacker could possibly use this issue to bypass blocklist
meschanisms. (CVE-2019-9948)
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain pickle files. An
attacker could possibly use this issue to consume memory, leading to a
denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when
handling cookies. An attacker could possibly trick Python into sending
cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly
handled Unicode encoding during NFKC normalization. An attacker could
possibly use this issue to obtain sensitive information. (CVE-2019-9636,
CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled
parsing certain X509 certificates. An attacker could possibly use this
issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 ESM. (CVE-2019-5010)
It was discovered that Python incorrectly handled certain urls. A remote
attacker could possibly use this issue to perform CRLF injection attacks.
(CVE-2019-9740, CVE-2019-9947)
Sihoon Lee discovered that Python incorrectly handled the local_file:
scheme. A remote attacker could possibly use this issue to bypass blocklist
meschanisms. (CVE-2019-9948)
References
- https://ubuntu.com/security/notices/USN-4127-2 Vendor Advisory
- https://ubuntu.com/security/CVE-2018-20406 Third Party Advisory
- https://ubuntu.com/security/CVE-2018-20852 Third Party Advisory
- https://ubuntu.com/security/CVE-2019-5010 Third Party Advisory
- https://ubuntu.com/security/CVE-2019-9636 Third Party Advisory
- https://ubuntu.com/security/CVE-2019-9740 Third Party Advisory
- https://ubuntu.com/security/CVE-2019-9947 Third Party Advisory
- https://ubuntu.com/security/CVE-2019-9948 Third Party Advisory
- https://ubuntu.com/security/CVE-2019-10160 Third Party Advisory
Timeline
Published10 Sep 2019
Updated8 Oct 2026
First seen8 Oct 2026
Sources
USN-4127-2 · OSV
Track software like this
Free during beta