Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 615
Alerts This Week
Warning Icon 1 615

Ubuntu: USN-6400-1 critical: Python Timing Attack Information Exposure

ubuntu
Calendar Grey September 27, 2023
Dist Ubuntu Esm H88
Python installations on Ubuntu could reveal private information. Check the specifics and follow the update guidelines for vulnerable releases. Take action now!
Python could be made to expose sensitive information.

Summary

Python could be made to expose sensitive information.

Software Description:

- python2.7: An interactive high-level object-oriented language

- python3.5: An interactive high-level object-oriented language

Details:

It was discovered that Python did not properly provide constant-time

processing for a crypto operation. An attacker could possibly use this

issue to perform a timing attack and recover sensitive information.

Topics%20covered

Topics Covered

security advisory Ubuntu timing attack information exposure Python

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   libpython2.7                    2.7.17-1~18.04ubuntu1.13+esm2
   libpython2.7-minimal      2.7.17-1~18.04ubuntu1.13+esm2
   libpython2.7-stdlib          2.7.17-1~18.04ubuntu1.13+esm2

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   libpython2.7                    2.7.12-1ubuntu0~16.04.18+esm7
   libpython2.7-minimal      2.7.12-1ubuntu0~16.04.18+esm7
   libpython2.7-stdlib          2.7.12-1ubuntu0~16.04.18+esm7
   libpython3.5                    3.5.2-2ubuntu0~16.04.13+esm11
   libpython3.5-minimal      3.5.2-2ubuntu0~16.04.13+esm11
   libpython3.5-stdlib          3.5.2-2ubuntu0~16.04.13+esm11

In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-6400-1

  CVE-2022-48566

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6400-1

Topics%20covered

Topics Covered

security advisory Ubuntu timing attack information exposure Python

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.