Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2924
python2.7 security update
28 September 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: python2.7
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-1000802 CVE-2018-14647 CVE-2018-1061
CVE-2018-1060
Reference: ESB-2018.2894
ESB-2018.2893
ESB-2018.2726
ESB-2018.2431
ESB-2018.1638
ESB-2018.1560
Original Bulletin:
http://www.debian.org/security/2018/dsa-4306
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4306-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
September 27, 2018 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : python2.7
CVE ID : CVE-2018-1060 CVE-2018-1061 CVE-2018-14647
CVE-2018-1000802
Multiple security issues were discovered in Python: ElementTree failed
to initialise Expat's hash salt, two denial of service issues were found
in difflib and poplib and the shutil module was affected by a command
injection vulnerability.
For the stable distribution (stretch), these problems have been fixed in
version 2.7.13-2+deb9u3.
We recommend that you upgrade your python2.7 packages.
For the detailed security status of python2.7 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python2.7
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlutRbcACgkQEMKTtsN8
Tjardg/9Fyn44Rb2l6FTrgQ3MVctqyyVxtQ/+vuSzS8hC3qqqYEDUHOExFwEaz1w
GfgweTVlQMkhdeyj3UZ8M7A9DwQPJDg2m2sQKZ1Tl4YKYUl6Q2BiQyMIUUjDCZ+w
Pj156sta68rOrU+WQ20PK+lewrc8nhK3WbXD60hgGabqzq5ioPg8WcmLjn/2FqXb
uv7g4xYMSGdN8f55AYVMeRNMU98C5nUPLHtKBecoRiLIZbFcmcLmT67DfgvaUYyc
h4RF4U7enqqf0eHQCV+0H+GbmqSAAInww7NJxXJR/8fLlDT64zxheawXv9duzuPD
L4UNvhr4/AfqKFA9WQjpmB1JVoOGxlttDczBlV6ZspR09ZYhiVJQvdrsEvwaqSBg
wsGYRynpiqmb0S0QzYNBLNRGnygP9rf/p1XoGUetLgL6acagc54Qqm+wWKZDL1J5
rQ50EsBGsxNMrJfmVA661Sc+30qE1TnEOH9cGL6oW8HdxeEhA9C6ul+iPQpdgOG6
hqTUmodas0Tt/Q3zoPMl8n2NsIDTP3MiCPzZ4SAmpx/RWi4F62CPTbxGs2z9cKgA
xHjiOYNqo2m3y2OtcayY05lzY6cdlwzYCq1FvhjNhAhqvHmOxLzE6SLMIzXVRi1E
AtBKq3+8p87yRFnbxf+AnpUavgpXdr+z0TLPBKn2//Cvg0HgV4g=
=WtMi
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW61mmGaOgq3Tt24GAQidUA//bdkhMSsIfPycpvZ1v5tExbEdqhmAq9kf
bCwd8ylr5mxRgrzOqANfv0aUsDdxut/qqJpKlKIVVAgu+mmYUAUcezvHt/AzbsF/
lK7y6xG+o8WhxZ5j/vYlMdRQuoXOkXudkJSYBvbe8ImFtYOyeVuSqKqcgiEj89ff
YHu2oRI86qE3LhJB7OLvBex1eaeLxaWORUIbLaYDvnnyExovbhIFMc1RLTkowj3h
/USX0v97uqK4FBq9E+aogqxkdd5qAQiVp7KrwQYxwl1LL6JLmwXsPDOJ+sGUO0nr
QSqL2PPNrAU1GnNd0V/2vc1bypngnFDrWBF6p0YRPQG1XNdx98zj3Fv/N+4vpGA/
d2wdQLiimA/7jCj/QDmxuz/oBwcrgtT5BbDMOvDMwQr3Fv9iFP9WTvjaUkEH0EJC
bihWyJtqodCEhQBFM6esaVJPpS48pzdPewzqXDkMjZJHk9ztMMc8Csbp4/tZUF+B
PvwarRX5jm9w/VDWEyhyrs5fNiSIcGYtic5Jhs4gfxxHw6Hr7TXPN8GW2J3nZo9E
n6HflnE7DSq8CJ9pFYWMWbIWRlhAd+1q9filtR9z4mB/Z0P30UpTzVEfcUzisjth
FUfn0xYBcLbkHcETqIYmgLx3yXbcFY/Ar8lmn3DTchpckRQOaPZwnhBI7mCLaIx1
u1UGJ7qCDCo=
=Tj3o
-----END PGP SIGNATURE-----