NULL pointer dereference in Python - CVE-2019-5010

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU17805

NULL pointer dereference in Python - CVE-2019-5010

Published: February 20, 2019 / Updated: April 7, 2020


Vulnerability identifier: #VU17805
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5010
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the X509 certificate parser of the affected software improperly handles X509 certificates with a certificate extension that uses a Certificate Revocation List (CRL) distribution point with empty distributionPoint and cRLIssuer fields. A remote attacker can send a request to initiate a Transport Layer Security (TLS) connection using an X509 certificate that submits malicious input, trigger a NULL pointer dereference condition that causes the application to crash, resulting in a DoS condition.


Affected software

Python
Amazon Linux AMI
Gentoo Linux
Fedora
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for x86_64
Slackware Linux
Ubuntu
Opensuse
Red Hat Software Collections
python2-tkinter (Alpine package)
python3-tkinter (Alpine package)
python3.9-minimal (Ubuntu package)
python3.5 (Ubuntu package)
python3.8 (Ubuntu package)
python3.5-minimal (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.11-minimal (Ubuntu package)
python3.11 (Ubuntu package)
python3.6 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python3.7 (Ubuntu package)
python3.7-minimal (Ubuntu package)
python2-docs
python2
python34
python35
python36
python3
python37
python3.10-minimal (Ubuntu package)
python3.10 (Ubuntu package)
python3.12-minimal (Ubuntu package)
python3.12 (Ubuntu package)
anaconda
Data Computing Appliance (DCA)
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

How to mitigate CVE-2019-5010

Install updates from vendor's website.

python2-tkinter (Alpine package) - addressed in versions 2.7.15-r3, 2.7.16-r0
python3-tkinter (Alpine package) - addressed in versions 3.6.8-r1, 3.7.3-r0
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.5-minimal (Ubuntu package) - update to Ubuntu Pro
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.10-0ubuntu1~20.04.10
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.6 (Ubuntu package) - update to Ubuntu Pro
python3.6-minimal (Ubuntu package) - update to Ubuntu Pro
python3.7 (Ubuntu package) - update to Ubuntu Pro
python3.7-minimal (Ubuntu package) - update to Ubuntu Pro
python2-docs - update to 2.7.16-1.fc30
python2 - update to 2.7.16-1.fc30
python34 - addressed in versions 3.4.10-1.el6, 3.4.10-1.el7, 3.4.10-1.fc28, 3.4.10-1.fc29, 3.4.10-1.fc30
python35 - addressed in versions 3.5.7-1.fc28, 3.5.7-1.fc29, 3.5.7-1.fc30
python36 - addressed in versions 3.6.8-1.el7, 3.6.8-3.fc29
python3 - addressed in versions 3.6.8-2.fc28, 3.7.2-4.fc29
python37 - update to 3.7.2-2.fc28
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
Data Computing Appliance (DCA) - update to 4.3.0.0
Dell EMC Unity Operating Environment (OE) - update to 5.0.0.0.5.116
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.0.0.5.116
anaconda - update to 29.24.7-2.fc29

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins