[SECURITY] [DSA 4307-1] python3.5 security update

2018-09-2819:17:56

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.006 Low

EPSS

Percentile

78.9%

JSON

Debian Security Advisory DSA-4307-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
September 28, 2018 https://www.debian.org/security/faq

Package : python3.5
CVE ID : CVE-2017-1000158 CVE-2018-1060 CVE-2018-1061
CVE-2018-14647

Multiple security issues were discovered in Python: ElementTree failed
to initialise Expat's hash salt, two denial of service issues were found
in difflib and poplib and a buffer overflow in PyString_DecodeEscape.

For the stable distribution (stretch), these problems have been fixed in
version 3.5.3-1+deb9u1.

We recommend that you upgrade your python3.5 packages.

For the detailed security status of python3.5 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python3.5

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9mips64elpython3.5-dbg< 3.5.3-1+deb9u1python3.5-dbg_3.5.3-1+deb9u1_mips64el.deb
Debian8armhfpython3.4-dbg< 3.4.2-1+deb8u1python3.4-dbg_3.4.2-1+deb8u1_armhf.deb
Debian9armelpython3.5-minimal< 3.5.3-1+deb9u1python3.5-minimal_3.5.3-1+deb9u1_armel.deb
Debian8amd64libpython3.4-dev< 3.4.2-1+deb8u1libpython3.4-dev_3.4.2-1+deb8u1_amd64.deb
Debian9allidle-python2.7< 2.7.13-2+deb9u3idle-python2.7_2.7.13-2+deb9u3_all.deb
Debian8armelpython2.7< 2.7.9-2+deb8u2python2.7_2.7.9-2+deb8u2_armel.deb
Debian8i386python2.7< 2.7.9-2+deb8u2python2.7_2.7.9-2+deb8u2_i386.deb
Debian9i386python2.7< 2.7.13-2+deb9u3python2.7_2.7.13-2+deb9u3_i386.deb
Debian8armhflibpython2.7< 2.7.9-2+deb8u2libpython2.7_2.7.9-2+deb8u2_armhf.deb
Debian8allidle-python3.4< 3.4.2-1+deb8u1idle-python3.4_3.4.2-1+deb8u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	mips64el	python3.5-dbg	< 3.5.3-1+deb9u1	python3.5-dbg_3.5.3-1+deb9u1_mips64el.deb
Debian	8	armhf	python3.4-dbg	< 3.4.2-1+deb8u1	python3.4-dbg_3.4.2-1+deb8u1_armhf.deb
Debian	9	armel	python3.5-minimal	< 3.5.3-1+deb9u1	python3.5-minimal_3.5.3-1+deb9u1_armel.deb
Debian	8	amd64	libpython3.4-dev	< 3.4.2-1+deb8u1	libpython3.4-dev_3.4.2-1+deb8u1_amd64.deb
Debian	9	all	idle-python2.7	< 2.7.13-2+deb9u3	idle-python2.7_2.7.13-2+deb9u3_all.deb
Debian	8	armel	python2.7	< 2.7.9-2+deb8u2	python2.7_2.7.9-2+deb8u2_armel.deb
Debian	8	i386	python2.7	< 2.7.9-2+deb8u2	python2.7_2.7.9-2+deb8u2_i386.deb
Debian	9	i386	python2.7	< 2.7.13-2+deb9u3	python2.7_2.7.13-2+deb9u3_i386.deb
Debian	8	armhf	libpython2.7	< 2.7.9-2+deb8u2	libpython2.7_2.7.9-2+deb8u2_armhf.deb
Debian	8	all	idle-python3.4	< 3.4.2-1+deb8u1	idle-python3.4_3.4.2-1+deb8u1_all.deb