Ubuntu 16.04/18.04 LTS/19.04 Moderate: Python Security Advisory

ubuntu

September 9, 2019

Several security issues were fixed in Python.

Summary

Several security issues were fixed in Python.

Software Description:

- python2.7: An interactive high-level object-oriented language

- python3.7: An interactive high-level object-oriented language

- python3.6: An interactive high-level object-oriented language

- python3.5: An interactive high-level object-oriented language

Details:

It was discovered that Python incorrectly handled certain pickle files. An

attacker could possibly use this issue to consume memory, leading to a

denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu

18.04 LTS. (CVE-2018-20406)

It was discovered that Python incorrectly validated the domain when

handling cookies. An attacker could possibly trick Python into sending

cookies to the wrong domain. (CVE-2018-20852)

Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly

handled Unicode encoding during NFKC normalization. An attacker could

possibly use this issue to obtain sensitive information. (C...

Read the Full Advisory

Topics Covered

security advisory denial of service code execution Ubuntu cookie handling Python X509

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  python2.7                       2.7.16-2ubuntu0.1
  python2.7-minimal               2.7.16-2ubuntu0.1
  python3.7                       3.7.3-2ubuntu0.1
  python3.7-minimal               3.7.3-2ubuntu0.1

Ubuntu 18.04 LTS:
  python2.7                       2.7.15-4ubuntu4~18.04.1
  python2.7-minimal               2.7.15-4ubuntu4~18.04.1
  python3.6                       3.6.8-1~18.04.2
  python3.6-minimal               3.6.8-1~18.04.2

Ubuntu 16.04 LTS:
  python2.7                       2.7.12-1ubuntu0~16.04.8
  python2.7-minimal               2.7.12-1ubuntu0~16.04.8
  python3.5                       3.5.2-2ubuntu0~16.04.8
  python3.5-minimal               3.5.2-2ubuntu0~16.04.8

In general, a standard system update will make all the necessary changes.