Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3034
python2.7 security update
25 May 2023
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: python2.7
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2022-45061 CVE-2021-4189 CVE-2021-3737
CVE-2021-3733 CVE-2021-3177 CVE-2020-26116
CVE-2020-8492 CVE-2019-20907 CVE-2015-20107
Original Bulletin:
http://www.debian.org/lts/security/2023/dla-3432
Comment: CVSS (Max): 9.8 CVE-2021-3177 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-3432-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Sylvain Beucler
May 24, 2023 https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------
Package : python2.7
Version : 2.7.16-2+deb10u2
CVE ID : CVE-2015-20107 CVE-2019-20907 CVE-2020-8492 CVE-2020-26116
CVE-2021-3177 CVE-2021-3733 CVE-2021-3737 CVE-2021-4189
CVE-2022-45061
Debian Bug : 970099
Multiple security issues were discovered in Python, an interactive
high-level object-oriented language. An attacker may cause command
injection, denial of service (DoS), request smuggling and port
scanning.
CVE-2015-20107
The mailcap module does not add escape characters into commands
discovered in the system mailcap file. This may allow attackers to
inject shell commands into applications that call
mailcap.findmatch with untrusted input (if they lack validation of
user-provided filenames or arguments).
CVE-2019-20907
In Lib/tarfile.py, an attacker is able to craft a TAR archive
leading to an infinite loop when opened by tarfile.open, because
_proc_pax lacks header validation.
CVE-2020-8492
Python allows an HTTP server to conduct Regular Expression Denial
of Service (ReDoS) attacks against a client because of
urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
CVE-2020-26116
http.client allows CRLF injection if the attacker controls the
HTTP request method, as demonstrated by inserting CR and LF
control characters in the first argument of
HTTPConnection.request.
CVE-2021-3177
Python has a buffer overflow in PyCArg_repr in _ctypes/callproc.c,
which may lead to remote code execution in certain Python
applications that accept floating-point numbers as untrusted
input, as demonstrated by a 1e300 argument to
c_double.from_param. This occurs because sprintf is used unsafely.
CVE-2021-3733
There's a flaw in urllib's AbstractBasicAuthHandler class. An
attacker who controls a malicious HTTP server that an HTTP client
(such as web browser) connects to, could trigger a Regular
Expression Denial of Service (ReDOS) during an authentication
request with a specially crafted payload that is sent by the
server to the client.
CVE-2021-3737
An improperly handled HTTP response in the HTTP client code of
python may allow a remote attacker, who controls the HTTP server,
to make the client script enter an infinite loop, consuming CPU
time.
CVE-2021-4189
The FTP (File Transfer Protocol) client library in PASV (passive)
mode trusts the host from the PASV response by default. This flaw
allows an attacker to set up a malicious FTP server that can trick
FTP clients into connecting back to a given IP address and
port. This vulnerability could lead to FTP client scanning
ports. For the rare user who wants the previous behavior, set a
`trust_server_pasv_ipv4_address` attribute on your `ftplib.FTP`
instance to True.
CVE-2022-45061
An unnecessary quadratic algorithm exists in one path when
processing some inputs to the IDNA (RFC 3490) decoder, such that a
crafted, unreasonably long name being presented to the decoder
could lead to a CPU denial of service.
For Debian 10 buster, these problems have been fixed in version
2.7.16-2+deb10u2.
We recommend that you upgrade your python2.7 packages.
For the detailed security status of python2.7 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python2.7
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmRuSaMACgkQDTl9HeUl
XjC5DBAAu3EocF61WC0lC2kAslYhYXuPe/lyNn6Pb+m2wBqlhYpH+/QBRuMo8PJG
omsbvzKZb4Gu6aG8PB1Oluu32sFKmNnYSM2yNu9K7VsxO7dGIqxYSaJgB2XZbOFd
FGjhxDhLVvJf6UyNmW3is6xnCas7F0q/EWxJ7lEYkboU4fnfwiCO0+0UT4reyDfr
RQ298Y+Zqire1UBOhoZQI/4xMs/3YHDl1pVYaqqsopPRGcgB2OGitDHasf9lVnsq
8AJKhVjmLPsHbuJFs3i2trxW4L+6lqtl+EO8SxqhWKmVpEbxXdPLIUMWoLECdEVL
DKS8sDjxnLT2SGycOPNlO9DYI0gO81DgjZhXhiGuUlMdlOyNwndDp31ianH0ZxxM
77fMWuKp/7xIBvEx39v+2Mcp2czETmbuCH5SvV+J86Mfq7wo+k4+g0rEBBCYnjbp
UQKYHAXSoDsZMjfsQgFLAyzH7Q381PY2ZkpapfJWwugzbnvgvxLsD2cQL4DawUKO
BhUE6qzt6qqB9rIa6uAU6Xqz9BkxWVsp6BkuHZPnNkJ2E3jUmYs6toDeHNzljQVy
gWnk/WzzwjfwdqaXpaRr/afzIX/3s0U21Cyn1YxtK/B1B5glIA4Ziw/GrMDi4tHe
JfId2g5Ava9vYyEhrCXP/b3yx0qCv1joSF9nrN14igBdpJUadNA=
=orjL
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZG7DbMkNZI30y1K9AQi6vA/+P/SU4Xx3agNTcXHF3+nDbBx7qSvRhAUP
PYDo1GuzDilTqCzd6Q7w/wQEjkZCUcvJg1Qg7PYWsapsb6ewFJS4AgHlE39EpNIO
3ZJyhfsZCfVz+wh1qhrC9v9Ti8OBF7WNRx0uUULnIatnJv0VKtcX9kU4VwrT+LM3
ckhN6ck6nnUyalNtFDvvGnwpfjj5gu1TwcRC/4nWcut3/SrLkrL3tghxyVy7jMTB
n3sYPUgBo9eN4jvaA4S6IVBr4fw/UUlNlQ6ytPLWT4HhhfUbYQthWIYE+8yuGKr3
z0iCICX2XyLfyXfbof3tyLnD2ugDeStzNH/NNc/t2S3l+OR7bYdisF7HnQPVB3Pu
JlqlcPQVujHvcdqy3Yc9lddNR7Q+IwGaaZsB/7qCl9KpPFb7NQwIr1ja65tZlOL7
ya/wfcqcnuS3Y+jtLGe62iHUD+UnTVs2hyiwp6Cr3wiC8jdtuO+NmRGxbd9fn42h
pe01mcjWEtO/XhnO7UJX+qck5poqjSuoifwhx3OHxkRjHlnjaMkTBFqATd/55cSs
DIzgWXjY86K5AgOKVhO8YedPpp3vdkSg9JMcuke6d2ZXgNFTea0ZVLF62njL2ijw
iCdf1qK+RPRsvcfWtr0EUczk4vGo6yIgY6sIIPUdkDo+zgvrojoTaOoYLyDSysoi
kCpJ7kwHuUs=
=sQXv
-----END PGP SIGNATURE-----