CVE-2012-0845

2012-02-1400:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.16 Low

EPSS

Percentile

95.9%

JSON

SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x
before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote
attackers to cause a denial of service (infinite loop and CPU consumption)
via an XML-RPC POST request that contains a smaller amount of data than
specified by the Content-Length header.

Bugs

<http://bugs.python.org/issue14001>

Notes

Author	Note
jdstrand	reproducer doesn’t work on 8.04 LTS python2.4, but the code is sufficiently similar that we’ll patch

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchpython2.4< 2.4.5-1ubuntu4.4UNKNOWN
ubuntu8.04noarchpython2.5< 2.5.2-2ubuntu6.2UNKNOWN
ubuntu10.04noarchpython2.6< 2.6.5-1ubuntu6.1UNKNOWN
ubuntu11.04noarchpython2.6< 2.6.6-6ubuntu7.1UNKNOWN
ubuntu11.10noarchpython2.6< 2.6.7-4ubuntu1.1UNKNOWN
ubuntu11.04noarchpython2.7< 2.7.1-5ubuntu2.2UNKNOWN
ubuntu11.10noarchpython2.7< 2.7.2-5ubuntu1.1UNKNOWN
ubuntu10.04noarchpython3.1< 3.1.2-0ubuntu3.2UNKNOWN
ubuntu11.04noarchpython3.1< 3.1.3-1ubuntu1.2UNKNOWN
ubuntu11.04noarchpython3.2< 3.2-1ubuntu1.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	python2.4	< 2.4.5-1ubuntu4.4	UNKNOWN
ubuntu	8.04	noarch	python2.5	< 2.5.2-2ubuntu6.2	UNKNOWN
ubuntu	10.04	noarch	python2.6	< 2.6.5-1ubuntu6.1	UNKNOWN
ubuntu	11.04	noarch	python2.6	< 2.6.6-6ubuntu7.1	UNKNOWN
ubuntu	11.10	noarch	python2.6	< 2.6.7-4ubuntu1.1	UNKNOWN
ubuntu	11.04	noarch	python2.7	< 2.7.1-5ubuntu2.2	UNKNOWN
ubuntu	11.10	noarch	python2.7	< 2.7.2-5ubuntu1.1	UNKNOWN
ubuntu	10.04	noarch	python3.1	< 3.1.2-0ubuntu3.2	UNKNOWN
ubuntu	11.04	noarch	python3.1	< 3.1.3-1ubuntu1.2	UNKNOWN
ubuntu	11.04	noarch	python3.2	< 3.2-1ubuntu1.2	UNKNOWN