在 Python 的证书解析代码中发现一个空指针取消引用漏洞。解析特制证书时，会对应用程序造成拒绝服务。若应用程序启用 SSL/TLS 证书验证，且只接受来自受信任 root 证书颁发机构的证书，就不太可能触发此漏洞。(CVE-2019-5010) Python 2.7.16 受到下列问题的影响：在 NFKC 规范化期间对 Unicode 编码处理不当（具有错误的 netloc）。影响为：信息泄漏（针对给定主机名缓存的凭据、cookie 等）。组件为：urllib.parse.urlsplit、urllib.parse.urlparse。攻击向量为：一个可能被错误解析的特制 URL，用来定位 cookie 或验证数据，并将该信息发送至与正确解析时不同的主机。(CVE-2019-9636) 在以 python 的 pop3lib's apop() 方法实施灾难性回溯的方式中发现缺陷。攻击者可利用此缺陷造成拒绝服务。(CVE-2018-1060) Python 2.7.16 中的模块/_pickle.c 通过在“重设大小到两倍大小”尝试期间错误处理的大型 LONG_BINPUT 值而产生一个整数溢出。此问题可能会造成内存耗尽，但是只有在 pickle 格式用于序列化数十或数百 GB 数据时才有意义。(CVE-2018-20406) 在以 python 的 difflib.IS_LINE_JUNK 方法实施灾难性回溯的方式中发现缺陷。攻击者可利用此缺陷造成拒绝服务。(CVE-2018-1061)

远程 Redhat Enterprise Linux 6/7 主机上安装的多个程序包受到 RHSA-2019:3725 公告中提及的多个漏洞影响。

  - python：在 pop3lib 中，通过 apop() 方法中的正则表达式灾难性回溯进行 DOS (CVE-2018-1060)

  - python：在 difflib 中，通过 difflib.IS_LINE_JUNK 方法中的正则表达式回溯进行 DOS (CVE-2018-1061)

  - python：_elementtree.c 模块中缺失 salt 初始化 (CVE-2018-14647)

  - python：如果序列化 GB 级的数据，Module/_pickle.c 中的整数溢出会导致内存耗尽 (CVE-2018-20406)

  - python：Cookie 域检查未返回正确结果 (CVE-2018-20852)

  - python：使用构建的 X509 证书造成空指针取消引用 (CVE-2019-5010)

  - python：通过传递至 urlopen() 的 url 查询部分注入 CRLF (CVE-2019-9740)

  - python：通过传递至 urlopen() 的 url 路径部分注入 CRLF (CVE-2019-9947)

  - python：未记录的 local_file 协议允许远程攻击者绕过保护机制 (CVE-2019-9948)

  - python：email.utils.parseaddr 错误解析电子邮件地址 (CVE-2019-16056)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

An update of the python3 package has been released.

Python is affected by improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. (CVE-2019-9636)

Modules/_pickle.c in Python has an integer overflow via a large LONG_BINPUT value that is mishandled during a 'resize to twice the size' attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. (CVE-2018-20406)

A NULL pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities. (CVE-2019-5010)

Python 2.7.16 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is:
Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. (CVE-2019-9636)

A flaw was found in the way catastrophic backtracking was implemented in python's pop3lib's apop() method. An attacker could use this flaw to cause denial of service. (CVE-2018-1060)

Modules/_pickle.c in Python 2.7.16 has an integer overflow via a large LONG_BINPUT value that is mishandled during a 'resize to twice the size' attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data. (CVE-2018-20406)

A flaw was found in the way catastrophic backtracking was implemented in python's difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service. (CVE-2018-1061)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3725 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: rh-python36-python (3.6.9).
    (BZ#1709344)

    Security Fix(es):

    * python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib     (CVE-2018-1061)

    * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)

    * python: Cookie domain check returns incorrect results (CVE-2018-20852)

    * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)

    * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

    * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

    * python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

    * python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib (CVE-2018-1060)

    * python: Integer overflow in Modules/_pickle.c allows for memory exhaustion if serializing gigabytes of     data (CVE-2018-20406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * urlsplit doesn't accept a NFKD hostname with a port number (BZ#1709340)

    * rh-python36 cannot unpickle datetime.date objects (BZ#1749103)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This DLA fixes a a problem parsing x509 certificates, an pickle integer overflow, and some other minor issues :

CVE-2016-0772

The smtplib library in CPython does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a 'StartTLS stripping attack.'

CVE-2016-5636

Integer overflow in the get_data function in zipimport.c in CPython allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

CVE-2016-5699

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

CVE-2018-20406

Modules/_pickle.c has an integer overflow via a large LONG_BINPUT value that is mishandled during a 'resize to twice the size' attempt.
This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data.

CVE-2019-5010

NULL pointer dereference using a specially crafted X509 certificate.

For Debian 8 'Jessie', these problems have been fixed in version 3.4.2-1+deb8u2.

We recommend that you upgrade your python3.4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
126383	Amazon Linux 2：python (ALAS-2019-1230)	Nessus	Amazon Linux Local Security Checks	2019/7/2	2024/5/13	critical
194161	RHEL 6/7：rh-python36-python (RHSA-2019:3725)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	critical
122909	Photon OS 2.0: Python3 PHSA-2019-2.0-0132	Nessus	PhotonOS Local Security Checks	2019/3/18	2024/7/23	high
124655	Amazon Linux AMI : python34 (ALAS-2019-1202)	Nessus	Amazon Linux Local Security Checks	2019/5/7	2024/5/28	critical
126383	Amazon Linux 2 : python (ALAS-2019-1230)	Nessus	Amazon Linux Local Security Checks	2019/7/2	2024/5/13	critical
194161	RHEL 6 / 7 : rh-python36-python (RHSA-2019:3725)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	critical
122036	Debian DLA-1663-1 : python3.4 security update	Nessus	Debian Local Security Checks	2019/2/8	2024/6/21	critical

检测

插件搜索

critical

critical

high

critical

critical

critical

critical