Vulnerabilities > CVE-2019-5010 - NULL Pointer Dereference vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

nessus

NVD

Published: 2019-10-31

Updated: 2024-11-21

Summary

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Python Python Python 3.7.0 Python Python 3.7.1 Python Python 3.7.2 Python Python 3.6.0 Python Python 3.6.1 Python Python 3.6.2 Python Python 3.6.3 Python Python 3.6.4 Python Python 3.6.5 Python Python 3.6.6 Python Python 3.6.7 Python Python 3.6.8 Python Python 3.6.9 Python Python 3.5.0 Python Python 3.5.1 Python Python 3.5.2 Python Python 3.5.3 Python Python 3.5.4 Python Python 3.5.5 Python Python 3.5.6 Python Python 2.7.0 Python Python 2.7.1 Python Python 2.7.2 Python Python 2.7.3 Python Python 2.7.4 Python Python 2.7.5 Python Python 2.7.6 Python Python 2.7.7 Python Python 2.7.8 Python Python 2.7.9 Python Python 2.7.10 Python Python 2.7.11 Python Python 2.7.12 Python Python 2.7.13 Python Python 2.7.14 Python Python 2.7.15 Python Python 3.4.0 Python Python 3.4.1 Python Python 3.4.2 Python Python 3.4.3 Python Python 3.4.4 Python Python 3.4.5 Python Python 3.4.6 Python Python 3.4.7 Python Python 3.4.8 Python Python 3.4.9	172
OS	Opensuse Opensuse Leap 15.1	1
OS	Debian Debian Debian Linux 9.0	1
OS	Redhat Redhat Enterprise Linux 8.0 Redhat Enterprise Linux EUS 8.1 Redhat Enterprise Linux EUS 8.2 Redhat Enterprise Linux EUS 8.4 Redhat Enterprise Linux EUS 8.6 Redhat Enterprise Linux Server TUS 8.2 Redhat Enterprise Linux Server TUS 8.4 Redhat Enterprise Linux Server TUS 8.6 Redhat Enterprise Linux Server AUS 8.2 Redhat Enterprise Linux Server AUS 8.4 Redhat Enterprise Linux Server AUS 8.6	11

Common Weakness Enumeration (CWE)

CWE-476 - NULL Pointer Dereference

Nessus

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0482-1.NASL
description	This update for python fixes the following issues : Security issues fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191). CVE-2018-14647: Fixed a denial-of-service vulnerability in Expat (bsc#1109847). Non-security issue fixed: Fixed a bug where PyWeakReference struct was not initialized correctly leading to a crash (bsc#1073748). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	122446
published	2019-02-26
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122446
title	SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2019:0482-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2019:0482-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(122446); script_version("1.3"); script_cvs_date("Date: 2020/02/07"); script_cve_id("CVE-2018-14647", "CVE-2019-5010"); script_name(english:"SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2019:0482-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for python fixes the following issues : Security issues fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191). CVE-2018-14647: Fixed a denial-of-service vulnerability in Expat (bsc#1109847). Non-security issue fixed: Fixed a bug where PyWeakReference struct was not initialized correctly leading to a crash (bsc#1073748). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1073748" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1109847" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1122191" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-14647/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-5010/" ); # https://www.suse.com/support/update/announcement/2019/suse-su-20190482-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?2d7e1e60" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE OpenStack Cloud 7:zypper in -t patch SUSE-OpenStack-Cloud-7-2019-482=1 SUSE Linux Enterprise Workstation Extension 12-SP4:zypper in -t patch SUSE-SLE-WE-12-SP4-2019-482=1 SUSE Linux Enterprise Workstation Extension 12-SP3:zypper in -t patch SUSE-SLE-WE-12-SP3-2019-482=1 SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-482=1 SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t patch SUSE-SLE-SDK-12-SP3-2019-482=1 SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch SUSE-SLE-SAP-12-SP2-2019-482=1 SUSE Linux Enterprise Server 12-SP4:zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-482=1 SUSE Linux Enterprise Server 12-SP3:zypper in -t patch SUSE-SLE-SERVER-12-SP3-2019-482=1 SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch SUSE-SLE-SERVER-12-SP2-2019-482=1 SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2019-482=1 SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch SUSE-SLE-SERVER-12-SP1-2019-482=1 SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2019-482=1 SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2019-482=1 SUSE Enterprise Storage 5:zypper in -t patch SUSE-Storage-5-2019-482=1 SUSE Enterprise Storage 4:zypper in -t patch SUSE-Storage-4-2019-482=1 SUSE CaaS Platform ALL : To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. SUSE CaaS Platform 3.0 : To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. OpenStack Cloud Magnum Orchestration 7:zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2019-482=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython2_7"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython2_7-1_0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython2_7-1_0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-base-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-curses"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-curses-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-demo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-gdbm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-gdbm-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-idle"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-tk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-tk-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-xml-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/25"); script_set_attribute(attribute:"patch_publication_date", value:"2019/02/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/26"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLED12\|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES12" && (! preg(pattern:"^(1\|2\|3\|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP1/2/3/4", os_ver + " SP" + sp); if (os_ver == "SLED12" && (! preg(pattern:"^(3\|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3/4", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES12", sp:"1", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-devel-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-devel-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-devel-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2020-0302-1.NASL
description	This update for python36 to version 3.6.10 fixes the following issues : CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507). CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ signs (bsc#1149955). CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	133448
published	2020-02-04
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133448
title	SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0302-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2020:0302-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(133448); script_version("1.2"); script_cvs_date("Date: 2020/02/06"); script_cve_id("CVE-2017-18207", "CVE-2018-1000802", "CVE-2018-1060", "CVE-2018-20852", "CVE-2019-10160", "CVE-2019-15903", "CVE-2019-16056", "CVE-2019-5010", "CVE-2019-9636", "CVE-2019-9947"); script_name(english:"SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0302-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for python36 to version 3.6.10 fixes the following issues : CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507). CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ signs (bsc#1149955). CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1027282" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1029377" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1081750" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1083507" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1086001" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1088009" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1094814" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1109663" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1137942" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1138459" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1141853" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1149121" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1149429" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1149792" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1149955" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1151490" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1159035" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1159622" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=709442" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=951166" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=983582" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2017-18207/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-1000802/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-1060/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-20852/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-10160/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-15903/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-16056/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-5010/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-9636/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-9947/" ); # https://www.suse.com/support/update/announcement/2020/suse-su-20200302-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?68a41617" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE Linux Enterprise Server 12-SP5 : zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-302=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython3_6m1_0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython3_6m1_0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-base-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-debugsource"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/01"); script_set_attribute(attribute:"patch_publication_date", value:"2020/02/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/04"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES12", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES12" && (! preg(pattern:"^(5)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP5", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES12", sp:"5", reference:"libpython3_6m1_0-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"libpython3_6m1_0-debuginfo-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-base-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-base-debuginfo-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-base-debugsource-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-debuginfo-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-debugsource-3.6.10-4.3.5")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python36"); }

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-6B02154AA0.NASL
description	Last upstream Python 3.4 security release, 3.4.10. Security fix for CVE-2019-9636, CVE-2019-5010, CVE-2018-20406. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	123475
published	2019-03-29
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123475
title	Fedora 29 : python34 (2019-6b02154aa0)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-1834.NASL
description	Multiple vulnerabilities were discovered in Python, an interactive high-level object-oriented language, including CVE-2018-14647 Python
last seen	2020-06-01
modified	2020-06-02
plugin id	126222
published	2019-06-25
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/126222
title	Debian DLA-1834-1 : python2.7 security update

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1336.NASL
description	According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.(CVE-2019-5010) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2019-05-06
plugin id	124622
published	2019-05-06
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124622
title	EulerOS 2.0 SP2 : python (EulerOS-SA-2019-1336)

NASL family	Amazon Linux Local Security Checks
NASL id	AL2_ALAS-2019-1230.NASL
description	A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities. (CVE-2019-5010) Python 2.7.16 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. (CVE-2019-9636) A flaw was found in the way catastrophic backtracking was implemented in python
last seen	2020-06-01
modified	2020-06-02
plugin id	126383
published	2019-07-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/126383
title	Amazon Linux 2 : python (ALAS-2019-1230)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-7D9F3CF3CE.NASL
description	Last upstream Python 3.4 security release, 3.4.10. Security fix for CVE-2019-9636, CVE-2019-5010, CVE-2018-20406. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	124511
published	2019-05-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124511
title	Fedora 30 : python34 (2019-7d9f3cf3ce)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-B8FFB3768D.NASL
description	Security fix for CVE-2019-5010 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2019-01-28
plugin id	121402
published	2019-01-28
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121402
title	Fedora 28 : python37 (2019-b8ffb3768d)

NASL family	Amazon Linux Local Security Checks
NASL id	AL2_ALAS-2019-1169.NASL
description	A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities.(CVE-2019-5010)
last seen	2020-06-01
modified	2020-06-02
plugin id	122675
published	2019-03-08
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122675
title	Amazon Linux 2 : python3 (ALAS-2019-1169)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-202003-26.NASL
description	The remote host is affected by the vulnerability described in GLSA-202003-26 (Python: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly perform a CRLF injection attack, obtain sensitive information, trick Python into sending cookies to the wrong domain or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
last seen	2020-03-19
modified	2020-03-16
plugin id	134603
published	2020-03-16
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/134603
title	GLSA-202003-26 : Python: Multiple vulnerabilities

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1357.NASL
description	According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Python
last seen	2020-06-01
modified	2020-06-02
plugin id	124735
published	2019-05-10
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124735
title	EulerOS Virtualization 2.5.3 : python (EulerOS-SA-2019-1357)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-3520.NASL
description	An update for python3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es) : * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010) * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740) * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947) * python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	130548
published	2019-11-06
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/130548
title	RHEL 8 : python3 (RHSA-2019:3520)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-4127-1.NASL
description	It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-20406) It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852) Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160) Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010) It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947) Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blacklist meschanisms. (CVE-2019-9948). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	128631
published	2019-09-10
reporter	Ubuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/128631
title	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : python2.7, python3.5, python3.6, python3.7 vulnerabilities (USN-4127-1)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-2_0-0190_PYTHON2.NASL
description	An update of the python2 package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	132534
published	2019-12-31
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/132534
title	Photon OS 2.0: Python2 PHSA-2019-2.0-0190

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-0C91CE7B3C.NASL
description	Update legacy Python to 2.7.16. Most significant improvement is that is builds against OpenSSL 1.1.1. See [upstream release announcement](https://www.python.org/downloads/release/python-2716/) and [changelog](https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7 .16.rst) (+ [rc1 changelog](https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7. 16rc1.rst)). Fixes the following CVEs : - [CVE-2019-5010](https://access.redhat.com/security/cve/c ve-2019-5010) Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet of Cisco. - [CVE-2013-1752](https://access.redhat.com/security/cve/c ve-2013-1752): Change use of readline() in `imaplib.IMAP4_SSL` to limit line length. ([CVE-2018-14647](https://access.redhat.com/security/cve/cve-2018-1464 7) is listed in upstream changelog, but it was already backported in Fedora.) Note that Python 2 is deprecated in Fedora 30 and users are advised to switch to Python 3. Upstream support of Python 2 ends on 2020-01-01. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	124470
published	2019-05-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124470
title	Fedora 30 : python2 / python2-docs (2019-0c91ce7b3c)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1594.NASL
description	According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.(CVE-2019-5010) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2019-05-29
plugin id	125521
published	2019-05-29
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125521
title	EulerOS 2.0 SP3 : python (EulerOS-SA-2019-1594)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-6BAEB15DA3.NASL
description	Last upstream Python 3.4 security release, 3.4.10. Security fix for CVE-2019-9636, CVE-2019-5010, CVE-2018-20406. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	123476
published	2019-03-29
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123476
title	Fedora 28 : python34 (2019-6baeb15da3)

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0229_PYTHON.NASL
description	The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python packages installed that are affected by multiple vulnerabilities: - An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability. (CVE-2019-5010) - urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen(
last seen	2020-06-01
modified	2020-06-02
plugin id	132508
published	2019-12-31
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/132508
title	NewStart CGSL CORE 5.05 / MAIN 5.05 : python Multiple Vulnerabilities (NS-SA-2019-0229)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-6FAFD84F5D.NASL
description	Security fix for CVE-2019-5010 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2019-02-05
plugin id	121577
published	2019-02-05
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121577
title	Fedora 28 : python3 (2019-6fafd84f5d)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-2030.NASL
description	An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es) : * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647) * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010) * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740) * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947) * python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	127651
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127651
title	RHEL 7 : python (RHSA-2019:2030)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1434.NASL
description	According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that Python
last seen	2020-06-01
modified	2020-06-02
plugin id	124937
published	2019-05-14
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124937
title	EulerOS Virtualization 3.0.1.0 : python (EulerOS-SA-2019-1434)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-292.NASL
description	This update for python fixes the following issues : Security issues fixed : - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191). - CVE-2018-14647: Fixed a denial-of-service vulnerability in Expat (bsc#1109847). Non-security issue fixed : - Fixed a bug where PyWeakReference struct was not initialized correctly leading to a crash (bsc#1073748). This update was imported from the SUSE:SLE-12-SP1:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	122642
published	2019-03-06
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122642
title	openSUSE Security Update : python (openSUSE-2019-292)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1626.NASL
description	According to the versions of the python packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Python
last seen	2020-06-01
modified	2020-06-02
plugin id	125578
published	2019-05-30
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125578
title	EulerOS Virtualization for ARM 64 3.0.2.0 : python (EulerOS-SA-2019-1626)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2019-1169.NASL
description	A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities. (CVE-2019-5010)
last seen	2020-06-01
modified	2020-06-02
plugin id	123082
published	2019-03-26
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123082
title	Amazon Linux AMI : python27 / python34,python35,python36 (ALAS-2019-1169)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-6E1938A3C5.NASL
description	Security update to Python 3.5.7. Security fix for CVE-2019-5010, CVE-2018-20406, CVE-2018-1060, CVE-2018-1061, CVE-2019-9636. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	123140
published	2019-03-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123140
title	Fedora 29 : python35 (2019-6e1938a3c5)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1338.NASL
description	According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Python
last seen	2020-05-06
modified	2019-05-06
plugin id	124624
published	2019-05-06
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124624
title	EulerOS 2.0 SP5 : python (EulerOS-SA-2019-1338)

NASL family	Slackware Local Security Checks
NASL id	SLACKWARE_SSA_2019-062-01.NASL
description	New python packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	122577
published	2019-03-04
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122577
title	Slackware 14.0 / 14.1 / 14.2 / current : python (SSA:2019-062-01)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-1663.NASL
description	This DLA fixes a a problem parsing x509 certificates, an pickle integer overflow, and some other minor issues : CVE-2016-0772 The smtplib library in CPython does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a
last seen	2020-06-01
modified	2020-06-02
plugin id	122036
published	2019-02-08
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122036
title	Debian DLA-1663-1 : python3.4 security update

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-00870E8BFC.NASL
description	Security fix for CVE-2019-5010 in Python. Anaconda is joined because an unrelated fix was done there that allowed to remove a workaround in Python. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2019-01-24
plugin id	121332
published	2019-01-24
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121332
title	Fedora 29 : anaconda / python3 (2019-00870e8bfc)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0215-1.NASL
description	This update for python3 fixes the following issues : Security issue fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) CVE-2018-20406: Fixed a integer overflow via a large LONG_BINPUT (bsc#1120644) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2019-02-01
plugin id	121540
published	2019-02-01
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121540
title	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2019:0215-1)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-7EB6D3B8EA.NASL
description	Security fix for CVE-2019-5010 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2019-02-05
plugin id	121579
published	2019-02-05
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121579
title	Fedora 29 : python36 (2019-7eb6d3b8ea)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2019-2030.NASL
description	An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es) : * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647) * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010) * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740) * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947) * python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	128333
published	2019-08-30
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/128333
title	CentOS 7 : python (CESA-2019:2030)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0223-1.NASL
description	This update for python fixes the following issues : Security issues fixed : CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751) CVE-2016-5636: heap overflow when importing malformed zip files (bsc#985177) CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348) CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523) CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	121570
published	2019-02-04
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121570
title	SUSE SLES12 Security Update : python (SUSE-SU-2019:0223-1) (httpoxy)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2020-0234-1.NASL
description	This update for python fixes the following issues : Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	133259
published	2020-01-27
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133259
title	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20190806_PYTHON_ON_SL7_X.NASL
description	Security Fix(es) : - python: Missing salt initialization in _elementtree.c module (CVE-2018-14647) - python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010) - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740) - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947) - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)
last seen	2020-03-18
modified	2019-08-27
plugin id	128254
published	2019-08-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/128254
title	Scientific Linux Security Update : python on SL7.x x86_64 (20190806)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_D74371D24FEE11E9A5CD1DF8A848DE3D.NASL
description	Python Changelog : bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet of Cisco.
last seen	2020-06-01
modified	2020-06-02
plugin id	123144
published	2019-03-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123144
title	FreeBSD : Python -- NULL pointer dereference vulnerability (d74371d2-4fee-11e9-a5cd-1df8a848de3d)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2020-0114-1.NASL
description	This update for python3 to version 3.6.10 fixes the following issues : CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507). CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955). CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	133036
published	2020-01-17
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133036
title	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-155.NASL
description	This update for python3 fixes the following issues : Security issue fixed : - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) - CVE-2018-20406: Fixed a integer overflow via a large LONG_BINPUT (bsc#1120644) This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	122091
published	2019-02-11
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122091
title	openSUSE Security Update : python3 (openSUSE-2019-155)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-51F1E08207.NASL
description	Security update to Python 3.5.7. Security fix for CVE-2019-5010, CVE-2018-20406, CVE-2018-1060, CVE-2018-1061, CVE-2019-9636. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	124492
published	2019-05-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124492
title	Fedora 30 : python35 (2019-51f1e08207)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-CF725DD20B.NASL
description	Security update to Python 3.5.7. Security fix for CVE-2019-5010, CVE-2018-20406, CVE-2018-1060, CVE-2018-1061, CVE-2019-9636. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	123480
published	2019-03-29
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123480
title	Fedora 28 : python35 (2019-cf725dd20b)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2020-86.NASL
description	This update for python3 to version 3.6.10 fixes the following issues : - CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507). - CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955). - CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429). This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	133172
published	2020-01-22
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133172
title	openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-184.NASL
description	This update for python fixes the following issues : Security issue fixed : - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	122226
published	2019-02-15
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122226
title	openSUSE Security Update : python (openSUSE-2019-184)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0243-1.NASL
description	This update for python3 fixes the following issues : Security issue fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) CVE-2018-20406: Fixed a integer overflow via a large LONG_BINPUT (bsc#1120644) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2019-02-06
plugin id	121616
published	2019-02-06
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121616
title	SUSE SLED12 / SLES12 Security Update : python3 (SUSE-SU-2019:0243-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0271-1.NASL
description	This update for python fixes the following issues : Security issue fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2019-02-07
plugin id	121636
published	2019-02-07
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121636
title	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2019:0271-1)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-1_0-0257_PYTHON2.NASL
description	An update of the python2 package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	132527
published	2019-12-31
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/132527
title	Photon OS 1.0: Python2 PHSA-2019-1.0-0257

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0187_PYTHON.NASL
description	The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python packages installed that are affected by multiple vulnerabilities: - Python
last seen	2020-06-01
modified	2020-06-02
plugin id	129884
published	2019-10-15
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/129884
title	NewStart CGSL CORE 5.04 / MAIN 5.04 : python Multiple Vulnerabilities (NS-SA-2019-0187)

Redhat

advisories

rhsa
id RHSA-2019:3520
rhsa
id RHSA-2019:3725

rpms

python-0:2.7.5-86.el7
python-debug-0:2.7.5-86.el7
python-debuginfo-0:2.7.5-86.el7
python-devel-0:2.7.5-86.el7
python-libs-0:2.7.5-86.el7
python-test-0:2.7.5-86.el7
python-tools-0:2.7.5-86.el7
tkinter-0:2.7.5-86.el7
platform-python-0:3.6.8-15.1.el8
platform-python-debug-0:3.6.8-15.1.el8
platform-python-devel-0:3.6.8-15.1.el8
python3-debuginfo-0:3.6.8-15.1.el8
python3-debugsource-0:3.6.8-15.1.el8
python3-idle-0:3.6.8-15.1.el8
python3-libs-0:3.6.8-15.1.el8
python3-test-0:3.6.8-15.1.el8
python3-tkinter-0:3.6.8-15.1.el8
rh-python36-python-0:3.6.9-2.el6
rh-python36-python-0:3.6.9-2.el7
rh-python36-python-debug-0:3.6.9-2.el6
rh-python36-python-debug-0:3.6.9-2.el7
rh-python36-python-debuginfo-0:3.6.9-2.el6
rh-python36-python-debuginfo-0:3.6.9-2.el7
rh-python36-python-devel-0:3.6.9-2.el6
rh-python36-python-devel-0:3.6.9-2.el7
rh-python36-python-libs-0:3.6.9-2.el6
rh-python36-python-libs-0:3.6.9-2.el7
rh-python36-python-test-0:3.6.9-2.el6
rh-python36-python-test-0:3.6.9-2.el7
rh-python36-python-tkinter-0:3.6.9-2.el6
rh-python36-python-tkinter-0:3.6.9-2.el7
rh-python36-python-tools-0:3.6.9-2.el6
rh-python36-python-tools-0:3.6.9-2.el7

Talos

id	TALOS-2019-0758
last seen	2019-11-07
published	2019-01-28
reporter	Talos Intelligence
source	http://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0758
title	Python.org CPython X509 certificate parsing denial-of-service vulnerability

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Nessus

Redhat

Talos

References