SB2018092706 - Debian update for python2.7
Published: September 27, 2018 Updated: March 18, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2018-1060)
The vulnerability allows a remote attacker to cause DoS condition on he target system.The weakness exists due to the way catastrophic backtracking was implemented in apop() method in pop3lib. A remote attacker can cause the service to crash.
2) Improper input validation (CVE-ID: CVE-2018-1061)
The vulnerability allows a remote attacker to cause DoS condition on he target system.The weakness exists due to the way catastrophic backtracking was implemented in python's difflib.IS_LINE_JUNK method difflib. A remote attacker can cause the service to crash.
3) XXE attack (CVE-ID: CVE-2018-14647)
The vulnerability allows a remote attacker to conduct XXE-attack.
The vulnerability exists due to improper handling of XML External Entities (XXEs) when parsing an XML file. A remote attacker can trick the victim into open an XML file that submits malicious input, trigger pathological hash collisions in Expat's internal data structures, consume large amounts CPU and RAM, and cause a denial of service (DoS) condition.
4) Command injection (CVE-ID: CVE-2018-1000802)
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to command injection in shutil module (make_archive function). A remote attacker can supply passage of unfiltered user input to the function and inject arbitrary commands to access arbitrary data or cause the service to crash.
Remediation
Install update from vendor's website.