Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Ubuntu 18.04 LTS USN-6354-1 High Severity Python Info Leak

ubuntu
Calendar Grey September 7, 2023
Dist Ubuntu Esm H88
On September 15, 2023, Debian announced security patch DSA-5050-1 addressing PHP flaws influencing various stable versions.
Python could be made to crash or leak sensitive information if it received specially crafted input.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Python could be made to crash or leak sensitive information if it received specially crafted input. Software Description: - python2.7: An interactive high-level object-oriented language - python3.5: An interactive high-level object-oriented language Details: It was discovered that Python did not properly handle XML entity declarations in plist files. An attacker could possibly use this vulnerability to perform an XML External Entity (XXE) injection, resulting in a denial of service or information disclosure.

Topics%20covered

Topics Covered

security advisory denial of service high severity ubuntu python information leak

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS (Available with Ubuntu Pro):   libpython2.7                       2.7.17-1~18.04ubuntu1.13+esm1   libpython2.7-stdlib             2.7.17-1~18.04ubuntu1.13+esm1   python2.7                          2.7.17-1~18.04ubuntu1.13+esm1   python2.7-minimal             2.7.17-1~18.04ubuntu1.13+esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro):   libpython2.7                       2.7.12-1ubuntu0~16.04.18+esm6   libpython2.7-stdlib             2.7.12-1ubuntu0~16.04.18+esm6   libpython3.5                       3.5.2-2ubuntu0~16.04.13+esm9   libpython3.5-stdlib             3.5.2-2ubuntu0~16.04.13+esm9   python2.7                          2.7.12-1ubuntu0~16.04.18+esm6   python2.7-minimal             2.7.12-1ubuntu0~16.04.18+esm6   python3.5                          3.5.2-2ubuntu0~16.04.13+esm9   python3.5-minimal             3.5.2-2ubuntu0~16.04.13+esm9 Ubuntu 14.04 LTS (Available with Ubuntu Pro):   libpython2.7                       2.7.6-8ubuntu0.6+esm16   libpython2.7-stdlib             2.7.6-8ubuntu0.6+esm16   python2.7                          2.7.6-8ubuntu0.6+esm16   python2.7-minimal            2.7.6-8ubuntu0.6+esm16 In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-6354-1

  CVE-2022-48565

Ubuntu Security Notice USN-6354-1

Topics%20covered

Topics Covered

security advisory denial of service high severity ubuntu python information leak

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here