Gentoo Archives: gentoo-announce

From: Thomas Deutschmann <whissi@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 201701-18 ] Python: Multiple vulnerabilities
Date: Tue, 10 Jan 2017 14:02:46
Message-Id: 2a638fcf-1b06-96fa-4e23-256e73c28844@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201701-18
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: Python: Multiple vulnerabilities
9 Date: January 10, 2017
10 Bugs: #531002, #585910, #585946
11 ID: 201701-18
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in Python, the worst of which
19 could lead to arbitrary code execution.
20
21 Background
22 ==========
23
24 Python is an interpreted, interactive, object-oriented programming
25 language.
26
27 Affected packages
28 =================
29
30 -------------------------------------------------------------------
31 Package / Vulnerable / Unaffected
32 -------------------------------------------------------------------
33 1 dev-lang/python < 3.4.5 *>= 2.7.12
34 >= 3.4.5
35
36 Description
37 ===========
38
39 Multiple vulnerabilities have been discovered in Python. Please review
40 the CVE identifiers referenced below for details.
41
42 Impact
43 ======
44
45 A remote attacker could entice a user to open a specially crafted index
46 file using Python's dumbdbm module, possibly resulting in execution of
47 arbitrary code with the privileges of the process.
48
49 A remote attacker could entice a user to process a specially crafted
50 input stream using Python's zipimporter module, possibly allowing
51 attackers to cause unspecified impact.
52
53 A man in the middle attacker could strip out the STARTTLS command
54 without generating an exception on the Python SMTP client application,
55 preventing the establishment of the TLS layer.
56
57 Workaround
58 ==========
59
60 There is no known workaround at this time.
61
62 Resolution
63 ==========
64
65 All Python 2 users should upgrade to the latest version:
66
67 # emerge --sync
68 # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.12:2.7"
69
70 All Python 3 users should upgrade to the latest version:
71
72 # emerge --sync
73 # emerge --ask --oneshot --verbose ">=dev-lang/python-3.4.5:3.4"
74
75 References
76 ==========
77
78 [ 1 ] CVE-2016-0772
79 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0772
80 [ 2 ] CVE-2016-5636
81 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5636
82
83 Availability
84 ============
85
86 This GLSA and any updates to it are available for viewing at
87 the Gentoo Security Website:
88
89 https://security.gentoo.org/glsa/201701-18
90
91 Concerns?
92 =========
93
94 Security is a primary focus of Gentoo Linux and ensuring the
95 confidentiality and security of our users' machines is of utmost
96 importance to us. Any security concerns should be addressed to
97 security@g.o or alternatively, you may file a bug at
98 https://bugs.gentoo.org.
99
100 License
101 =======
102
103 Copyright 2017 Gentoo Foundation, Inc; referenced text
104 belongs to its owner(s).
105
106 The contents of this document are licensed under the
107 Creative Commons - Attribution / Share Alike license.
108
109 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature