-------------------------------------------------------------------------
Debian LTS Advisory DLA-3575-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                        Helmut Grohne
September 20, 2023                            https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : python2.7
Version        : 2.7.16-2+deb10u3
CVE ID         : CVE-2021-23336 CVE-2022-0391 CVE-2022-48560 CVE-2022-48565
                 CVE-2022-48566 CVE-2023-24329 CVE-2023-40217

This update fixes multiple vulnerabilities concerning the urlparse module as
well as vulnerabilities concerning the heapq, hmac, plistlib and ssl modules.

CVE-2021-23336

    Python was vulnerable to Web Cache Poisoning via urlparse.parse_qsl and
    urlparse.parse_qs by using a vector called parameter cloaking. When the
    attacker can separate query parameters using a semicolon (;), they can
    cause a difference in the interpretation of the request between the proxy
    (running with default configuration) and the server. This can result in
    malicious requests being cached as completely safe ones, as the proxy would
    usually not see the semicolon as a separator, and therefore would not
    include it in a cache key of an unkeyed parameter.

CVE-2022-0391

    The urlparse module helps break Uniform Resource Locator (URL) strings into
    components. The issue involves how the urlparse method does not sanitize
    input and allows characters like '\r' and '\n' in the URL path.  This flaw
    allows an attacker to input a crafted URL, leading to injection attacks.

CVE-2022-48560

    A use-after-free exists in Python via heappushpop in heapq.

CVE-2022-48565

    An XML External Entity (XXE) issue was discovered in Python.  The plistlib
    module no longer accepts entity declarations in XML plist files to avoid
    XML vulnerabilities.

CVE-2022-48566

    An issue was discovered in compare_digest in Lib/hmac.py in Python.
    Constant-time-defeating optimisations were possible in the accumulator
    variable in hmac.compare_digest.

CVE-2023-24329

    An issue in the urlparse component of Python allows attackers to bypass
    blocklisting methods by supplying a URL that starts with blank characters.

CVE-2023-40217

    The issue primarily affects servers written in Python (such as HTTP
    servers) that use TLS client authentication. If a TLS server-side socket is
    created, receives data into the socket buffer, and then is closed quickly,
    there is a brief window where the SSLSocket instance will detect the socket
    as "not connected" and won't initiate a handshake, but buffered data will
    still be readable from the socket buffer.  This data will not be
    authenticated if the server-side TLS peer is expecting client certificate
    authentication, and is indistinguishable from valid TLS stream data. Data
    is limited in size to the amount that will fit in the buffer. (The TLS
    connection cannot directly be used for data exfiltration because the
    vulnerable code path requires that the connection be closed on
    initialization of the SSLSocket.)


For Debian 10 buster, these problems have been fixed in version
2.7.16-2+deb10u3.

We recommend that you upgrade your python2.7 packages.

For the detailed security status of python2.7 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/python2.7

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Debian LTS: DLA-3575-1: python2.7 security update

September 20, 2023
This update fixes multiple vulnerabilities concerning the urlparse module as well as vulnerabilities concerning the heapq, hmac, plistlib and ssl modules

Summary

CVE-2021-23336

Python was vulnerable to Web Cache Poisoning via urlparse.parse_qsl and
urlparse.parse_qs by using a vector called parameter cloaking. When the
attacker can separate query parameters using a semicolon (;), they can
cause a difference in the interpretation of the request between the proxy
(running with default configuration) and the server. This can result in
malicious requests being cached as completely safe ones, as the proxy would
usually not see the semicolon as a separator, and therefore would not
include it in a cache key of an unkeyed parameter.

CVE-2022-0391

The urlparse module helps break Uniform Resource Locator (URL) strings into
components. The issue involves how the urlparse method does not sanitize
input and allows characters like '\r' and '\n' in the URL path. This flaw
allows an attacker to input a crafted URL, leading to injection attacks.

CVE-2022-48560

A use-after-free exists in Python via heappushpop in heapq.

CVE-2022-48565

An XML External Entity (XXE) issue was discovered in Python. The plistlib
module no longer accepts entity declarations in XML plist files to avoid
XML vulnerabilities.

CVE-2022-48566

An issue was discovered in compare_digest in Lib/hmac.py in Python.
Constant-time-defeating optimisations were possible in the accumulator
variable in hmac.compare_digest.

CVE-2023-24329

An issue in the urlparse component of Python allows attackers to bypass
blocklisting methods by supplying a URL that starts with blank characters.

CVE-2023-40217

The issue primarily affects servers written in Python (such as HTTP
servers) that use TLS client authentication. If a TLS server-side socket is
created, receives data into the socket buffer, and then is closed quickly,
there is a brief window where the SSLSocket instance will detect the socket
as "not connected" and won't initiate a handshake, but buffered data will
still be readable from the socket buffer. This data will not be
authenticated if the server-side TLS peer is expecting client certificate
authentication, and is indistinguishable from valid TLS stream data. Data
is limited in size to the amount that will fit in the buffer. (The TLS
connection cannot directly be used for data exfiltration because the
vulnerable code path requires that the connection be closed on
initialization of the SSLSocket.)


For Debian 10 buster, these problems have been fixed in version
2.7.16-2+deb10u3.

We recommend that you upgrade your python2.7 packages.

For the detailed security status of python2.7 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/python2.7

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
Package : python2.7
Version : 2.7.16-2+deb10u3
CVE ID : CVE-2021-23336 CVE-2022-0391 CVE-2022-48560 CVE-2022-48565

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo