Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Red Hat Enterprise Linux 7: RHSA-2016-2586-02 Low: Python Heap Overflow

red hat
Calendar Grey November 3, 2016
Scroller Redhat
A minor Python security advisory has been issued for Red Hat Enterprise Linux 7, addressing a critical vulnerability that could allow unauthorized code execution.
An update for python is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* A vulnerability was discovered in Python, in the built-in zipimporter. A specially crafted zip file placed in a module path such that it would be loaded by a later "import" statement could cause a heap overflow, leading to arbitrary code execution. (CVE-2016-5636)
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory bug fix arbitrary code execution Red Hat Enterprise Linux heap overflow low severity Python

References

https://access.redhat.com/security/cve/CVE-2016-5636 https://access.redhat.com/security/updates/classification#low https://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: python-2.7.5-48.el7.src.rpm
x86_64: python-2.7.5-48.el7.x86_64.rpm python-debuginfo-2.7.5-48.el7.i686.rpm python-debuginfo-2.7.5-48.el7.x86_64.rpm python-libs-2.7.5-48.el7.i686.rpm python-libs-2.7.5-48.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: python-debug-2.7.5-48.el7.x86_64.rpm python-debuginfo-2.7.5-48.el7.x86_64.rpm python-devel-2.7.5-48.el7.x86_64.rpm python-test-2.7.5-48.el7.x86_64.rpm python-tools-2.7.5-48.el7.x86_64.rpm tkinter-2.7.5-48.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: python-2.7.5-48.el7.src.rpm
x86_64: python-2.7.5-48.el7.x86_64.rpm python-debuginfo-2.7.5-48.el7.i686.rpm python-debuginfo-2.7.5-48.el7.x86_64.rpm python-devel-2.7.5-48.el7.x86_64.rpm python-libs-2.7.5-48.el7.i686.rpm python-libs-2.7.5-48.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: python-debug-2.7.5-48.el7.x86_64.rpm python-debuginfo-2.7.5-48.el7.x86_64.rpm python-test-2.7.5-48.el7.x86_64.rpm python-tools-2.7.5-48.el7.x86_64.rpm tkinter-2.7.5-48.el7.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: python-2.7.5-48.el7.src.rpm
aarch64: python-2.7.5-48.el7.aarch64.rpm python-debuginfo-2.7.5-48.el7.aarch64.rpm python-devel-2.7.5-48.el7.aarch64.rpm

Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2016:2586-02
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2016:2586.html
Issue date: 2016-11-03

Topic

An update for python is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Low. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory bug fix arbitrary code execution Red Hat Enterprise Linux heap overflow low severity Python

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Bugs Fixed

1268310 - man page contains $Date$ instead of actual date

1271760 - Python 2.7 installation is not 64 bit clean

1288426 - /etc/tmpfiles.d/python.conf shipped when /etc/tmpfiles.d is reserved for the local administrator

1295459 - python-2.7.5-34 breaks hashlib (md4)

1301017 - I'm hit by Python bug #11489, could the fix be backported?

1313259 - Upstream tests cause building python package on brew stall and leave orphan processes that need manually kill

1315310 - Python brew builds fail for RHEL 7.3

1315758 - Update to the most recent version of PEP493

1331425 - Segmentation fault in sslwrap function

1345856 - CVE-2016-5636 python: Heap overflow in zipimporter module

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.