Vulnerabilities > CVE-2019-5010 - NULL Pointer Dereference vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-0482-1.NASL description This update for python fixes the following issues : Security issues fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191). CVE-2018-14647: Fixed a denial-of-service vulnerability in Expat (bsc#1109847). Non-security issue fixed: Fixed a bug where PyWeakReference struct was not initialized correctly leading to a crash (bsc#1073748). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 122446 published 2019-02-26 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122446 title SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2019:0482-1) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2019:0482-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(122446); script_version("1.3"); script_cvs_date("Date: 2020/02/07"); script_cve_id("CVE-2018-14647", "CVE-2019-5010"); script_name(english:"SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2019:0482-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for python fixes the following issues : Security issues fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191). CVE-2018-14647: Fixed a denial-of-service vulnerability in Expat (bsc#1109847). Non-security issue fixed: Fixed a bug where PyWeakReference struct was not initialized correctly leading to a crash (bsc#1073748). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1073748" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1109847" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1122191" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-14647/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-5010/" ); # https://www.suse.com/support/update/announcement/2019/suse-su-20190482-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?2d7e1e60" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE OpenStack Cloud 7:zypper in -t patch SUSE-OpenStack-Cloud-7-2019-482=1 SUSE Linux Enterprise Workstation Extension 12-SP4:zypper in -t patch SUSE-SLE-WE-12-SP4-2019-482=1 SUSE Linux Enterprise Workstation Extension 12-SP3:zypper in -t patch SUSE-SLE-WE-12-SP3-2019-482=1 SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-482=1 SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t patch SUSE-SLE-SDK-12-SP3-2019-482=1 SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch SUSE-SLE-SAP-12-SP2-2019-482=1 SUSE Linux Enterprise Server 12-SP4:zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-482=1 SUSE Linux Enterprise Server 12-SP3:zypper in -t patch SUSE-SLE-SERVER-12-SP3-2019-482=1 SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch SUSE-SLE-SERVER-12-SP2-2019-482=1 SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2019-482=1 SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch SUSE-SLE-SERVER-12-SP1-2019-482=1 SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2019-482=1 SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2019-482=1 SUSE Enterprise Storage 5:zypper in -t patch SUSE-Storage-5-2019-482=1 SUSE Enterprise Storage 4:zypper in -t patch SUSE-Storage-4-2019-482=1 SUSE CaaS Platform ALL : To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. SUSE CaaS Platform 3.0 : To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. OpenStack Cloud Magnum Orchestration 7:zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2019-482=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython2_7"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython2_7-1_0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython2_7-1_0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-base-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-curses"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-curses-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-demo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-gdbm"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-gdbm-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-idle"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-tk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-tk-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-xml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python-xml-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/25"); script_set_attribute(attribute:"patch_publication_date", value:"2019/02/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/26"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES12" && (! preg(pattern:"^(1|2|3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP1/2/3/4", os_ver + " SP" + sp); if (os_ver == "SLED12" && (! preg(pattern:"^(3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3/4", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES12", sp:"1", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-devel-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"1", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"4", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"3", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-demo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-gdbm-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-gdbm-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-idle-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLES12", sp:"2", reference:"python-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-devel-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libpython2_7-1_0-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libpython2_7-1_0-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libpython2_7-1_0-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-base-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-base-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-base-debuginfo-32bit-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-base-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-curses-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-curses-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-debugsource-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-devel-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-tk-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-tk-debuginfo-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-xml-2.7.13-28.21.1")) flag++; if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"python-xml-debuginfo-2.7.13-28.21.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python"); }NASL family SuSE Local Security Checks NASL id SUSE_SU-2020-0302-1.NASL description This update for python36 to version 3.6.10 fixes the following issues : CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507). CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ signs (bsc#1149955). CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 133448 published 2020-02-04 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133448 title SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0302-1) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2020:0302-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(133448); script_version("1.2"); script_cvs_date("Date: 2020/02/06"); script_cve_id("CVE-2017-18207", "CVE-2018-1000802", "CVE-2018-1060", "CVE-2018-20852", "CVE-2019-10160", "CVE-2019-15903", "CVE-2019-16056", "CVE-2019-5010", "CVE-2019-9636", "CVE-2019-9947"); script_name(english:"SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0302-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for python36 to version 3.6.10 fixes the following issues : CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507). CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ signs (bsc#1149955). CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1027282" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1029377" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1081750" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1083507" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1086001" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1088009" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1094814" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1109663" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1137942" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1138459" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1141853" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1149121" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1149429" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1149792" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1149955" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1151490" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1159035" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1159622" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=709442" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=951166" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=983582" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2017-18207/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-1000802/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-1060/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-20852/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-10160/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-15903/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-16056/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-5010/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-9636/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-9947/" ); # https://www.suse.com/support/update/announcement/2020/suse-su-20200302-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?68a41617" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE Linux Enterprise Server 12-SP5 : zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-302=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython3_6m1_0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpython3_6m1_0-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-base-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:python36-debugsource"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/01"); script_set_attribute(attribute:"patch_publication_date", value:"2020/02/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/04"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES12", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES12" && (! preg(pattern:"^(5)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP5", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES12", sp:"5", reference:"libpython3_6m1_0-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"libpython3_6m1_0-debuginfo-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-base-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-base-debuginfo-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-base-debugsource-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-debuginfo-3.6.10-4.3.5")) flag++; if (rpm_check(release:"SLES12", sp:"5", reference:"python36-debugsource-3.6.10-4.3.5")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "python36"); }NASL family Fedora Local Security Checks NASL id FEDORA_2019-6B02154AA0.NASL description Last upstream Python 3.4 security release, 3.4.10. Security fix for CVE-2019-9636, CVE-2019-5010, CVE-2018-20406. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 123475 published 2019-03-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123475 title Fedora 29 : python34 (2019-6b02154aa0) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1834.NASL description Multiple vulnerabilities were discovered in Python, an interactive high-level object-oriented language, including CVE-2018-14647 Python last seen 2020-06-01 modified 2020-06-02 plugin id 126222 published 2019-06-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126222 title Debian DLA-1834-1 : python2.7 security update NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1336.NASL description According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.(CVE-2019-5010) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-05-06 modified 2019-05-06 plugin id 124622 published 2019-05-06 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124622 title EulerOS 2.0 SP2 : python (EulerOS-SA-2019-1336) NASL family Amazon Linux Local Security Checks NASL id AL2_ALAS-2019-1230.NASL description A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities. (CVE-2019-5010) Python 2.7.16 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. (CVE-2019-9636) A flaw was found in the way catastrophic backtracking was implemented in python last seen 2020-06-01 modified 2020-06-02 plugin id 126383 published 2019-07-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126383 title Amazon Linux 2 : python (ALAS-2019-1230) NASL family Fedora Local Security Checks NASL id FEDORA_2019-7D9F3CF3CE.NASL description Last upstream Python 3.4 security release, 3.4.10. Security fix for CVE-2019-9636, CVE-2019-5010, CVE-2018-20406. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124511 published 2019-05-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124511 title Fedora 30 : python34 (2019-7d9f3cf3ce) NASL family Fedora Local Security Checks NASL id FEDORA_2019-B8FFB3768D.NASL description Security fix for CVE-2019-5010 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-18 modified 2019-01-28 plugin id 121402 published 2019-01-28 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121402 title Fedora 28 : python37 (2019-b8ffb3768d) NASL family Amazon Linux Local Security Checks NASL id AL2_ALAS-2019-1169.NASL description A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities.(CVE-2019-5010) last seen 2020-06-01 modified 2020-06-02 plugin id 122675 published 2019-03-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122675 title Amazon Linux 2 : python3 (ALAS-2019-1169) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-202003-26.NASL description The remote host is affected by the vulnerability described in GLSA-202003-26 (Python: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly perform a CRLF injection attack, obtain sensitive information, trick Python into sending cookies to the wrong domain or cause a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-03-19 modified 2020-03-16 plugin id 134603 published 2020-03-16 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134603 title GLSA-202003-26 : Python: Multiple vulnerabilities NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1357.NASL description According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Python last seen 2020-06-01 modified 2020-06-02 plugin id 124735 published 2019-05-10 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124735 title EulerOS Virtualization 2.5.3 : python (EulerOS-SA-2019-1357) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-3520.NASL description An update for python3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es) : * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010) * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740) * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947) * python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 130548 published 2019-11-06 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/130548 title RHEL 8 : python3 (RHSA-2019:3520) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-4127-1.NASL description It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-20406) It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852) Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160) Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010) It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947) Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blacklist meschanisms. (CVE-2019-9948). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 128631 published 2019-09-10 reporter Ubuntu Security Notice (C) 2019 Canonical, Inc. / NASL script (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/128631 title Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : python2.7, python3.5, python3.6, python3.7 vulnerabilities (USN-4127-1) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2019-2_0-0190_PYTHON2.NASL description An update of the python2 package has been released. last seen 2020-06-01 modified 2020-06-02 plugin id 132534 published 2019-12-31 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132534 title Photon OS 2.0: Python2 PHSA-2019-2.0-0190 NASL family Fedora Local Security Checks NASL id FEDORA_2019-0C91CE7B3C.NASL description Update legacy Python to 2.7.16. Most significant improvement is that is builds against OpenSSL 1.1.1. See [upstream release announcement](https://www.python.org/downloads/release/python-2716/) and [changelog](https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7 .16.rst) (+ [rc1 changelog](https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7. 16rc1.rst)). Fixes the following CVEs : - [CVE-2019-5010](https://access.redhat.com/security/cve/c ve-2019-5010) Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet of Cisco. - [CVE-2013-1752](https://access.redhat.com/security/cve/c ve-2013-1752): Change use of readline() in `imaplib.IMAP4_SSL` to limit line length. ([CVE-2018-14647](https://access.redhat.com/security/cve/cve-2018-1464 7) is listed in upstream changelog, but it was already backported in Fedora.) Note that Python 2 is deprecated in Fedora 30 and users are advised to switch to Python 3. Upstream support of Python 2 ends on 2020-01-01. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124470 published 2019-05-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124470 title Fedora 30 : python2 / python2-docs (2019-0c91ce7b3c) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1594.NASL description According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.(CVE-2019-5010) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-05-06 modified 2019-05-29 plugin id 125521 published 2019-05-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125521 title EulerOS 2.0 SP3 : python (EulerOS-SA-2019-1594) NASL family Fedora Local Security Checks NASL id FEDORA_2019-6BAEB15DA3.NASL description Last upstream Python 3.4 security release, 3.4.10. Security fix for CVE-2019-9636, CVE-2019-5010, CVE-2018-20406. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 123476 published 2019-03-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123476 title Fedora 28 : python34 (2019-6baeb15da3) NASL family NewStart CGSL Local Security Checks NASL id NEWSTART_CGSL_NS-SA-2019-0229_PYTHON.NASL description The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python packages installed that are affected by multiple vulnerabilities: - An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability. (CVE-2019-5010) - urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen( last seen 2020-06-01 modified 2020-06-02 plugin id 132508 published 2019-12-31 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132508 title NewStart CGSL CORE 5.05 / MAIN 5.05 : python Multiple Vulnerabilities (NS-SA-2019-0229) NASL family Fedora Local Security Checks NASL id FEDORA_2019-6FAFD84F5D.NASL description Security fix for CVE-2019-5010 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2019-02-05 plugin id 121577 published 2019-02-05 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121577 title Fedora 28 : python3 (2019-6fafd84f5d) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-2030.NASL description An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es) : * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647) * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010) * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740) * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947) * python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 127651 published 2019-08-12 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127651 title RHEL 7 : python (RHSA-2019:2030) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1434.NASL description According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that Python last seen 2020-06-01 modified 2020-06-02 plugin id 124937 published 2019-05-14 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124937 title EulerOS Virtualization 3.0.1.0 : python (EulerOS-SA-2019-1434) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-292.NASL description This update for python fixes the following issues : Security issues fixed : - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191). - CVE-2018-14647: Fixed a denial-of-service vulnerability in Expat (bsc#1109847). Non-security issue fixed : - Fixed a bug where PyWeakReference struct was not initialized correctly leading to a crash (bsc#1073748). This update was imported from the SUSE:SLE-12-SP1:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 122642 published 2019-03-06 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122642 title openSUSE Security Update : python (openSUSE-2019-292) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1626.NASL description According to the versions of the python packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Python last seen 2020-06-01 modified 2020-06-02 plugin id 125578 published 2019-05-30 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125578 title EulerOS Virtualization for ARM 64 3.0.2.0 : python (EulerOS-SA-2019-1626) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2019-1169.NASL description A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities. (CVE-2019-5010) last seen 2020-06-01 modified 2020-06-02 plugin id 123082 published 2019-03-26 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123082 title Amazon Linux AMI : python27 / python34,python35,python36 (ALAS-2019-1169) NASL family Fedora Local Security Checks NASL id FEDORA_2019-6E1938A3C5.NASL description Security update to Python 3.5.7. Security fix for CVE-2019-5010, CVE-2018-20406, CVE-2018-1060, CVE-2018-1061, CVE-2019-9636. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 123140 published 2019-03-27 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123140 title Fedora 29 : python35 (2019-6e1938a3c5) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1338.NASL description According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Python last seen 2020-05-06 modified 2019-05-06 plugin id 124624 published 2019-05-06 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124624 title EulerOS 2.0 SP5 : python (EulerOS-SA-2019-1338) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2019-062-01.NASL description New python packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 122577 published 2019-03-04 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122577 title Slackware 14.0 / 14.1 / 14.2 / current : python (SSA:2019-062-01) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1663.NASL description This DLA fixes a a problem parsing x509 certificates, an pickle integer overflow, and some other minor issues : CVE-2016-0772 The smtplib library in CPython does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a last seen 2020-06-01 modified 2020-06-02 plugin id 122036 published 2019-02-08 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122036 title Debian DLA-1663-1 : python3.4 security update NASL family Fedora Local Security Checks NASL id FEDORA_2019-00870E8BFC.NASL description Security fix for CVE-2019-5010 in Python. Anaconda is joined because an unrelated fix was done there that allowed to remove a workaround in Python. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2019-01-24 plugin id 121332 published 2019-01-24 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121332 title Fedora 29 : anaconda / python3 (2019-00870e8bfc) NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-0215-1.NASL description This update for python3 fixes the following issues : Security issue fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) CVE-2018-20406: Fixed a integer overflow via a large LONG_BINPUT (bsc#1120644) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-18 modified 2019-02-01 plugin id 121540 published 2019-02-01 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121540 title SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2019:0215-1) NASL family Fedora Local Security Checks NASL id FEDORA_2019-7EB6D3B8EA.NASL description Security fix for CVE-2019-5010 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2019-02-05 plugin id 121579 published 2019-02-05 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121579 title Fedora 29 : python36 (2019-7eb6d3b8ea) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2019-2030.NASL description An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es) : * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647) * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010) * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740) * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947) * python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 128333 published 2019-08-30 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/128333 title CentOS 7 : python (CESA-2019:2030) NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-0223-1.NASL description This update for python fixes the following issues : Security issues fixed : CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751) CVE-2016-5636: heap overflow when importing malformed zip files (bsc#985177) CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348) CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523) CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 121570 published 2019-02-04 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121570 title SUSE SLES12 Security Update : python (SUSE-SU-2019:0223-1) (httpoxy) NASL family SuSE Local Security Checks NASL id SUSE_SU-2020-0234-1.NASL description This update for python fixes the following issues : Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 133259 published 2020-01-27 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133259 title SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy) NASL family Scientific Linux Local Security Checks NASL id SL_20190806_PYTHON_ON_SL7_X.NASL description Security Fix(es) : - python: Missing salt initialization in _elementtree.c module (CVE-2018-14647) - python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010) - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740) - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947) - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948) last seen 2020-03-18 modified 2019-08-27 plugin id 128254 published 2019-08-27 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/128254 title Scientific Linux Security Update : python on SL7.x x86_64 (20190806) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_D74371D24FEE11E9A5CD1DF8A848DE3D.NASL description Python Changelog : bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet of Cisco. last seen 2020-06-01 modified 2020-06-02 plugin id 123144 published 2019-03-27 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123144 title FreeBSD : Python -- NULL pointer dereference vulnerability (d74371d2-4fee-11e9-a5cd-1df8a848de3d) NASL family SuSE Local Security Checks NASL id SUSE_SU-2020-0114-1.NASL description This update for python3 to version 3.6.10 fixes the following issues : CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507). CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955). CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 133036 published 2020-01-17 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133036 title SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-155.NASL description This update for python3 fixes the following issues : Security issue fixed : - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) - CVE-2018-20406: Fixed a integer overflow via a large LONG_BINPUT (bsc#1120644) This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 122091 published 2019-02-11 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122091 title openSUSE Security Update : python3 (openSUSE-2019-155) NASL family Fedora Local Security Checks NASL id FEDORA_2019-51F1E08207.NASL description Security update to Python 3.5.7. Security fix for CVE-2019-5010, CVE-2018-20406, CVE-2018-1060, CVE-2018-1061, CVE-2019-9636. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124492 published 2019-05-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124492 title Fedora 30 : python35 (2019-51f1e08207) NASL family Fedora Local Security Checks NASL id FEDORA_2019-CF725DD20B.NASL description Security update to Python 3.5.7. Security fix for CVE-2019-5010, CVE-2018-20406, CVE-2018-1060, CVE-2018-1061, CVE-2019-9636. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 123480 published 2019-03-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123480 title Fedora 28 : python35 (2019-cf725dd20b) NASL family SuSE Local Security Checks NASL id OPENSUSE-2020-86.NASL description This update for python3 to version 3.6.10 fixes the following issues : - CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507). - CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955). - CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429). This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 133172 published 2020-01-22 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133172 title openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-184.NASL description This update for python fixes the following issues : Security issue fixed : - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 122226 published 2019-02-15 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122226 title openSUSE Security Update : python (openSUSE-2019-184) NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-0243-1.NASL description This update for python3 fixes the following issues : Security issue fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) CVE-2018-20406: Fixed a integer overflow via a large LONG_BINPUT (bsc#1120644) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-18 modified 2019-02-06 plugin id 121616 published 2019-02-06 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121616 title SUSE SLED12 / SLES12 Security Update : python3 (SUSE-SU-2019:0243-1) NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-0271-1.NASL description This update for python fixes the following issues : Security issue fixed : CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-18 modified 2019-02-07 plugin id 121636 published 2019-02-07 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121636 title SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2019:0271-1) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2019-1_0-0257_PYTHON2.NASL description An update of the python2 package has been released. last seen 2020-06-01 modified 2020-06-02 plugin id 132527 published 2019-12-31 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132527 title Photon OS 1.0: Python2 PHSA-2019-1.0-0257 NASL family NewStart CGSL Local Security Checks NASL id NEWSTART_CGSL_NS-SA-2019-0187_PYTHON.NASL description The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python packages installed that are affected by multiple vulnerabilities: - Python last seen 2020-06-01 modified 2020-06-02 plugin id 129884 published 2019-10-15 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/129884 title NewStart CGSL CORE 5.04 / MAIN 5.04 : python Multiple Vulnerabilities (NS-SA-2019-0187)
Redhat
| advisories |
| ||||||||
| rpms |
|
Talos
| id | TALOS-2019-0758 |
| last seen | 2019-11-07 |
| published | 2019-01-28 |
| reporter | Talos Intelligence |
| source | http://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0758 |
| title | Python.org CPython X509 certificate parsing denial-of-service vulnerability |
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758
- https://access.redhat.com/errata/RHSA-2019:3520
- https://access.redhat.com/errata/RHSA-2019:3725
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
- https://security.gentoo.org/glsa/202003-26
- https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E