CVE-2019-5010

2019-01-1800:00:00

ubuntu.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.018 Low

EPSS

Percentile

88.2%

JSON

An exploitable denial-of-service vulnerability exists in the X509
certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted
X509 certificate can cause a NULL pointer dereference, resulting in a
denial of service. An attacker can initiate or accept TLS connections using
crafted certificates to trigger this vulnerability.

Bugs

<https://bugs.python.org/issue35746>

Notes

Author	Note
mdeslaur	DoS is only possible in certain situations, see upstream bug report. Marking as low.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpython2.7< 2.7.15-4ubuntu4~18.04.1UNKNOWN
ubuntu18.10noarchpython2.7< 2.7.16-2~18.10UNKNOWN
ubuntu16.04noarchpython2.7< 2.7.12-1ubuntu0~16.04.8UNKNOWN
ubuntu14.04noarchpython3.4< 3.4.3-1ubuntu1~14.04.7+esm2) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN
ubuntu14.04noarchpython3.5< anyUNKNOWN
ubuntu16.04noarchpython3.5< 3.5.2-2ubuntu0~16.04.8UNKNOWN
ubuntu18.04noarchpython3.6< 3.6.8-1~18.04.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	python2.7	< 2.7.15-4ubuntu4~18.04.1	UNKNOWN
ubuntu	18.10	noarch	python2.7	< 2.7.16-2~18.10	UNKNOWN
ubuntu	16.04	noarch	python2.7	< 2.7.12-1ubuntu0~16.04.8	UNKNOWN
ubuntu	14.04	noarch	python3.4	< 3.4.3-1ubuntu1~14.04.7+esm2) Available with Ubuntu Pro or Ubuntu Pro (Infra-only	UNKNOWN
ubuntu	14.04	noarch	python3.5	< any	UNKNOWN
ubuntu	16.04	noarch	python3.5	< 3.5.2-2ubuntu0~16.04.8	UNKNOWN
ubuntu	18.04	noarch	python3.6	< 3.6.8-1~18.04.2	UNKNOWN