[SECURITY] [DSA 4306-1] python2.7 security update

2018-09-2721:05:32

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

74.7%

JSON

Debian Security Advisory DSA-4306-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
September 27, 2018 https://www.debian.org/security/faq

Package : python2.7
CVE ID : CVE-2018-1060 CVE-2018-1061 CVE-2018-14647
CVE-2018-1000802

Multiple security issues were discovered in Python: ElementTree failed
to initialise Expat's hash salt, two denial of service issues were found
in difflib and poplib and the shutil module was affected by a command
injection vulnerability.

For the stable distribution (stretch), these problems have been fixed in
version 2.7.13-2+deb9u3.

We recommend that you upgrade your python2.7 packages.

For the detailed security status of python2.7 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python2.7

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9arm64libpython3.5-dev< 3.5.3-1+deb9u1libpython3.5-dev_3.5.3-1+deb9u1_arm64.deb
Debian9armhfpython3.5< 3.5.3-1+deb9u1python3.5_3.5.3-1+deb9u1_armhf.deb
Debian9ppc64ellibpython3.5-dev< 3.5.3-1+deb9u1libpython3.5-dev_3.5.3-1+deb9u1_ppc64el.deb
Debian8armellibpython3.4-stdlib< 3.4.2-1+deb8u3libpython3.4-stdlib_3.4.2-1+deb8u3_armel.deb
Debian8allpython2.7-doc< 2.7.9-2+deb8u3python2.7-doc_2.7.9-2+deb8u3_all.deb
Debian9arm64libpython3.5-stdlib< 3.5.3-1+deb9u1libpython3.5-stdlib_3.5.3-1+deb9u1_arm64.deb
Debian9mipsellibpython2.7-dev< 2.7.13-2+deb9u3libpython2.7-dev_2.7.13-2+deb9u3_mipsel.deb
Debian8armellibpython2.7-dbg< 2.7.9-2+deb8u3libpython2.7-dbg_2.7.9-2+deb8u3_armel.deb
Debian8i386libpython2.7-minimal< 2.7.9-2+deb8u3libpython2.7-minimal_2.7.9-2+deb8u3_i386.deb
Debian9i386python2.7-dev< 2.7.13-2+deb9u3python2.7-dev_2.7.13-2+deb9u3_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	arm64	libpython3.5-dev	< 3.5.3-1+deb9u1	libpython3.5-dev_3.5.3-1+deb9u1_arm64.deb
Debian	9	armhf	python3.5	< 3.5.3-1+deb9u1	python3.5_3.5.3-1+deb9u1_armhf.deb
Debian	9	ppc64el	libpython3.5-dev	< 3.5.3-1+deb9u1	libpython3.5-dev_3.5.3-1+deb9u1_ppc64el.deb
Debian	8	armel	libpython3.4-stdlib	< 3.4.2-1+deb8u3	libpython3.4-stdlib_3.4.2-1+deb8u3_armel.deb
Debian	8	all	python2.7-doc	< 2.7.9-2+deb8u3	python2.7-doc_2.7.9-2+deb8u3_all.deb
Debian	9	arm64	libpython3.5-stdlib	< 3.5.3-1+deb9u1	libpython3.5-stdlib_3.5.3-1+deb9u1_arm64.deb
Debian	9	mipsel	libpython2.7-dev	< 2.7.13-2+deb9u3	libpython2.7-dev_2.7.13-2+deb9u3_mipsel.deb
Debian	8	armel	libpython2.7-dbg	< 2.7.9-2+deb8u3	libpython2.7-dbg_2.7.9-2+deb8u3_armel.deb
Debian	8	i386	libpython2.7-minimal	< 2.7.9-2+deb8u3	libpython2.7-minimal_2.7.9-2+deb8u3_i386.deb
Debian	9	i386	python2.7-dev	< 2.7.13-2+deb9u3	python2.7-dev_2.7.13-2+deb9u3_i386.deb