Gentoo Archives: gentoo-announce

From: Thomas Deutschmann <whissi@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 202005-09 ] Python: Denial of Service
Date: Thu, 14 May 2020 22:20:37
Message-Id: 1c691bcb-a1dc-8180-d059-f04b040fc7d5@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 202005-09
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: Python: Denial of Service
9 Date: May 14, 2020
10 Bugs: #707822
11 ID: 202005-09
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 A vulnerability in Python could lead to a Denial of Service condition.
19
20 Background
21 ==========
22
23 Python is an interpreted, interactive, object-oriented programming
24 language.
25
26 Affected packages
27 =================
28
29 -------------------------------------------------------------------
30 Package / Vulnerable / Unaffected
31 -------------------------------------------------------------------
32 1 dev-lang/python < 2.7.18:2.7 >= 2.7.18:2.7
33 < 3.6.10-r2:3.6 >= 3.6.10-r2:3.6
34 < 3.7.7-r2:3.7 >= 3.7.7-r2:3.7
35 < 3.8.2-r2:3.8 >= 3.8.2-r2:3.8
36
37 Description
38 ===========
39
40 An issue was discovered in urllib.request.AbstractBasicAuthHandler
41 which allowed a remote attacker to send malicious data causing
42 extensive regular expression backtracking.
43
44 Impact
45 ======
46
47 An attacker could cause a possible Denial of Service condition.
48
49 Workaround
50 ==========
51
52 There is no known workaround at this time.
53
54 Resolution
55 ==========
56
57 All Python 2.7 users should upgrade to the latest version:
58
59 # emerge --sync
60 # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18:2.7"
61
62 All Python 3.6 users should upgrade to the latest version:
63
64 # emerge --sync
65 # emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.10-r2:3.6"
66
67 All Python 3.7 users should upgrade to the latest version:
68
69 # emerge --sync
70 # emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.7-r2:3.7"
71
72 All Python 3.8 users should upgrade to the latest version:
73
74 # emerge --sync
75 # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.2-r2:3.8"
76
77 References
78 ==========
79
80 [ 1 ] CVE-2020-8492
81 https://nvd.nist.gov/vuln/detail/CVE-2020-8492
82
83 Availability
84 ============
85
86 This GLSA and any updates to it are available for viewing at
87 the Gentoo Security Website:
88
89 https://security.gentoo.org/glsa/202005-09
90
91 Concerns?
92 =========
93
94 Security is a primary focus of Gentoo Linux and ensuring the
95 confidentiality and security of our users' machines is of utmost
96 importance to us. Any security concerns should be addressed to
97 security@g.o or alternatively, you may file a bug at
98 https://bugs.gentoo.org.
99
100 License
101 =======
102
103 Copyright 2020 Gentoo Foundation, Inc; referenced text
104 belongs to its owner(s).
105
106 The contents of this document are licensed under the
107 Creative Commons - Attribution / Share Alike license.
108
109 https://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature