Stay Secure with the Latest Linux Advisories

security advisorydenial of servicehigh severity

Ubuntu 18.04 LTS USN-6354-1 High Severity Python Info Leak

Python could be made to crash or leak sensitive information if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-6354-1 September 07, 2023 python2.7, python3.5 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Python could be made to crash or leak sensitive information if it received specially crafted input. Software Description: - python2.7: An interactive high-level object-oriented language - python3.5: An interactive high-level object-oriented language Details: It was discovered that Python did not properly handle XML entity declarations in plist files. An attacker could possibly use this vulnerability to perform an XML External Entity (XXE) injection, resulting in a denial of service or information disclosure. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS (Available with Ubuntu Pro): libpython2.7 2.7.17-1~18.04ubuntu1.13+esm1 libpython2.7-stdlib 2.7.17-1~18.04ubuntu1.13+esm1 python2.7 2.7.17-1~18.04ubuntu1.13+esm1 python2.7-minimal 2.7.17-1~18.04ubuntu1.13+esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): libpython2.7 2.7.12-1ubuntu0~16.04.18+esm6 libpython2.7-stdlib 2.7.12-1ubuntu0~16.04.18+esm6 libpython3.5 3.5.2-2ubuntu0~16.04.13+esm9 libpython3.5-stdlib 3.5.2-2ubuntu0~16.04.13+esm9 python2.7 2.7.12-1ubuntu0~16.04.18+esm6 python2.7-minimal 2.7.12-1ubuntu0~16.04.18+esm6 python3.5 3.5.2-2ubuntu0~16.04.13+esm9 python3.5-minimal 3.5.2-2ubuntu0~16.04.13+esm9 Ubuntu 14.04 LTS (Available with Ubuntu Pro): libpython2.7 2.7.6-8ubuntu0.6+esm16 libpython2.7-stdlib 2.7.6-8ubuntu0.6+esm16 python2.7 2.7.6-8ubuntu0.6+esm16 python2.7-minimal 2.7.6-8ubuntu0.6+esm16 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6354-1 CVE-2022-48565 . On September 15, 2023, Debian announced security patch DSA-5050-1 addressing PHP flaws influencing various stable versions.. Python Vulnerability, Information Disclosure, Ubuntu Security, Security Advisory, Update Instructions. . LinuxSecurity.com Team

Sep 07, 2023 Ubuntu