Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Gentoo: GLSA 202005-09 Normal: Python Denial of Service Issue

gentoo
Calendar Grey May 14, 2020
Dist Gentoo Esm H88
Weakness in Python on Gentoo could result in Denial of Service; update immediately to reduce exposure and boost protection.
A vulnerability in Python could lead to a Denial of Service condition.

Summary

An issue was discovered in urllib.request.AbstractBasicAuthHandler which allowed a remote attacker to send malicious data causing extensive regular expression backtracking.

Topics%20covered

Topics Covered

security advisory denial of service gentoo python normal severity

Resolution

All Python 2.7 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/python-2.7.18:2.7"
All Python 3.6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/python-3.6.10-r2:3.6"
All Python 3.7 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/python-3.7.7-r2:3.7"
All Python 3.8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/python-3.8.2-r2:3.8"

References

[ 1 ] CVE-2020-8492 https://nvd.nist.gov/vuln/detail/CVE-2020-8492

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202005-09
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: Python: Denial of Service
Date: May 14, 2020
Bugs: #707822
ID: 202005-09

Topics%20covered

Topics Covered

security advisory denial of service gentoo python normal severity

Synopsis

A vulnerability in Python could lead to a Denial of Service condition.

Background

Python is an interpreted, interactive, object-oriented programming language.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/python < 2.7.18:2.7 >= 2.7.18:2.7 < 3.6.10-r2:3.6 >= 3.6.10-r2:3.6 < 3.7.7-r2:3.7 >= 3.7.7-r2:3.7 < 3.8.2-r2:3.8 >= 3.8.2-r2:3.8

Impact

===== An attacker could cause a possible Denial of Service condition.

Workaround

There is no known workaround at this time.

Your message here