Multiple vulnerabilities were found in the CPython interpreter which can cause denial of service, information gain, and arbitrary code execution.

CVE-2017-1000158

CPython (aka Python) is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)

CVE-2018-1060

python is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVE-2018-1061

python is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.

CVE-2018-1000802

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function.

For Debian 8 'Jessie', these problems have been fixed in version 2.7.9-2+deb8u2.

We recommend that you upgrade your python2.7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3817-1 advisory.

    It was discovered that Python incorrectly handled large amounts of data. A remote attacker could use this     issue to cause Python to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2018-1000030)

    It was discovered that Python incorrectly handled running external commands in the shutil module. A remote     attacker could use this issue to cause Python to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2018-1000802)

    It was discovered that Python incorrectly used regular expressions vulnerable to catastrophic     backtracking. A remote attacker could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2018-1060, CVE-2018-1061)

    It was discovered that Python failed to initialize Expat's hash salt. A remote attacker could possibly use     this issue to cause hash collisions, leading to a denial of service. (CVE-2018-14647)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python fixes the following issue :

CVE-2018-1000802: Prevent command injection in shutil module (make_archive function) via passage of unfiltered user input (bsc#1109663)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K000139691 advisory.

  - An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer     accepts entity declarations in XML plist files to avoid XML vulnerabilities. (CVE-2022-48565)

  - Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of     Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive     function) that can result in Denial of service, Information gain via injection of arbitrary files on the     system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the     function. This vulnerability appears to have been fixed in after commit     add531a1e55b0a739b0f42582f1c9747e5649ace. (CVE-2018-1000802)

  - An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox     < 50. (CVE-2016-9063)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python3 fixes the following issues :

CVE-2019-10160: Fixed a regression in urlparse() and urlsplit() introduced by the fix for CVE-2019-9636 (bsc#1138459).

CVE-2018-14647: Fixed a denial of service vulnerability caused by a crafted XML document (bsc#1109847).

CVE-2018-1000802: Fixed a command injection in the shutil module (bsc#1109663).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
117712	Debian DLA-1519-1 : python2.7 security update	Nessus	Debian Local Security Checks	2018/9/27	2024/8/5	critical
118954	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-3817-1)	Nessus	Ubuntu Local Security Checks	2018/11/14	2025/9/3	critical
120119	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2018:3002-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	critical
197530	F5 Networks BIG-IP : Python vulnerabilities (K000139691)	Nessus	F5 Networks Local Security Checks	2024/5/20	2024/10/3	critical
128019	SUSE SLES12 Security Update : python3 (SUSE-SU-2019:2053-2)	Nessus	SuSE Local Security Checks	2019/8/20	2024/5/2	critical

检测

插件搜索

critical

critical

critical

critical

critical