Ubuntu 6354-1: Python vulnerability
Summary
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Python could be made to crash or leak sensitive information if it received specially crafted input. Software Description: - python2.7: An interactive high-level object-oriented language - python3.5: An interactive high-level object-oriented language Details: It was discovered that Python did not properly handle XML entity declarations in plist files. An attacker could possibly use this vulnerability to perform an XML External Entity (XXE) injection, resulting in a denial of service or information disclosure.
Update Instructions
The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS (Available with Ubuntu Pro): libpython2.7 2.7.17-1~18.04ubuntu1.13+esm1 libpython2.7-stdlib 2.7.17-1~18.04ubuntu1.13+esm1 python2.7 2.7.17-1~18.04ubuntu1.13+esm1 python2.7-minimal 2.7.17-1~18.04ubuntu1.13+esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): libpython2.7 2.7.12-1ubuntu0~16.04.18+esm6 libpython2.7-stdlib 2.7.12-1ubuntu0~16.04.18+esm6 libpython3.5 3.5.2-2ubuntu0~16.04.13+esm9 libpython3.5-stdlib 3.5.2-2ubuntu0~16.04.13+esm9 python2.7 2.7.12-1ubuntu0~16.04.18+esm6 python2.7-minimal 2.7.12-1ubuntu0~16.04.18+esm6 python3.5 3.5.2-2ubuntu0~16.04.13+esm9 python3.5-minimal 3.5.2-2ubuntu0~16.04.13+esm9 Ubuntu 14.04 LTS (Available with Ubuntu Pro): libpython2.7 2.7.6-8ubuntu0.6+esm16 libpython2.7-stdlib 2.7.6-8ubuntu0.6+esm16 python2.7 2.7.6-8ubuntu0.6+esm16 python2.7-minimal 2.7.6-8ubuntu0.6+esm16 In general, a standard system update will make all the necessary changes.
References
https://ubuntu.com/security/notices/USN-6354-1
CVE-2022-48565
Package Information
