Ubuntu 20.10 USN-4754-2 High: Python Code Execution Threats

ubuntu

February 25, 2021

Python could be made to execute arbitrary code or denial of service if it received a specially crafted input.

Summary

Python could be made to execute arbitrary code or denial of service if it

received a specially crafted input.

Software Description:

- python3.8: Interactive high-level object-oriented language (version 3.8)

- python2.7: An interactive high-level object-oriented language

- python3.6: An interactive high-level object-oriented language

- python3.5: An interactive high-level object-oriented language

- python3.4: An interactive high-level object-oriented language

Details:

It was discovered that Python incorrectly handled certain inputs.

An attacker could possibly use this issue to execute arbitrary code

or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)

Topics Covered

security advisory denial of service high severity critical code execution arbitrary code execution ubuntu python input handling

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  python3.8                       3.8.6-1ubuntu0.2
  python3.8-minimal               3.8.6-1ubuntu0.2

Ubuntu 20.04 LTS:
  python3.8                       3.8.5-1~20.04.2
  python3.8-minimal               3.8.5-1~20.04.2

Ubuntu 18.04 LTS:
  python2.7                       2.7.17-1~18.04ubuntu1.3
  python2.7-minimal               2.7.17-1~18.04ubuntu1.3
  python3.6                       3.6.9-1~18.04ubuntu1.4
  python3.6-minimal               3.6.9-1~18.04ubuntu1.4

Ubuntu 16.04 LTS:
  python2.7                       2.7.12-1ubuntu0~16.04.14
  python2.7-minimal               2.7.12-1ubuntu0~16.04.14
  python3.5                       3.5.2-2ubuntu0~16.04.13
  python3.5-minimal               3.5.2-2ubuntu0~16.04.13

Ubuntu 14.04 ESM:
  python2.7                       2.7.6-8ubuntu0.6+esm8
  python2.7-minimal               2.7.6-8ubuntu0.6+esm8
  python3.4                       3.4.3-1ubuntu1~14.04.7+esm10
  python3.4-minimal               3.4.3-1ubuntu1~14.04.7+esm10

In general, a standard system update will make all the necessary changes.