Denial-of-Service Vulnerability in Python.org Python
Summary
CVE-2019-5010: An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. Affects python2 across 2 version ranges.
< 2.7.15-r3
< 413a49145e35c7a2d3a7de27c5a1828449c9b2e5
Fixed in 2.7.15-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python.org Python is an open-source programming language widely used for various applications. It provides a rich set of libraries and frameworks for developers. However, a vulnerability has been discovered in Python.org Python versions 2.7.11 and 3.6.6, which can lead to a denial-of-service (DoS) attack. This vulnerability affects the X509 certificate parser in Python, allowing an attacker to trigger a NULL pointer dereference by using a specially crafted X509 certificate. As a result, the application may crash, causing a DoS condition. This vulnerability can be exploited by initiating or accepting TLS connections using the malicious certificate.
Vulnerability Detail
The vulnerability, identified as CVE-2019-5010, poses a significant risk to applications utilizing Python.org Python. By exploiting this vulnerability, an attacker can cause a DoS condition, potentially disrupting the availability of the affected application. The issue lies in the X509 certificate parser, which fails to handle certain inputs correctly, leading to a NULL pointer dereference. This vulnerability has a CVSS score of 7.5, indicating a high severity level. It is crucial for organizations using Python.org Python to address this vulnerability promptly to mitigate the risk of potential attacks.
How To Fix
Minimum fixed version
2.7.15-r3
This is the first release that contains the fix.
sudo apk add --upgrade python2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if updating to the fixed versions is not immediately feasible, it is recommended to disable TLS connections or restrict the usage of TLS to trusted sources only. This can be achieved by modifying the application's configuration or firewall rules to block TLS connections. However, this workaround may impact the functionality of the application and should be considered temporary until the Python.org Python installation can be updated.
Conclusion
The denial-of-service vulnerability in Python.org Python versions 2.7.11 and 3.6.6 can be exploited by a specially crafted X509 certificate, leading to a NULL pointer dereference and a potential DoS condition. It is crucial for organizations using Python.org Python to update their installations to the fixed versions (2.7.15-r3 for Python 2.7.11 and 3.6.8-r1 for Python 3.6.6) to mitigate the risk. Additionally, temporary measures such as disabling TLS connections or restricting their usage can be applied until the update is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python2 →
FAQ
This vulnerability can lead to a denial-of-service (DoS) condition in applications using Python.org Python. An attacker can exploit the vulnerability to crash the application, causing unavailability and potential disruption of services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes the manifest file, such as package-lock.json, to identify and alert in real-time for open-source vulnerabilities, including this one.
Yes, the vulnerability can be fixed by updating the Python.org Python installation to the fixed versions. For Python 2.7.11, update to version 2.7.15-r3, and for Python 3.6.6, update to version 3.6.8-r1.
As a temporary measure, you can disable TLS connections or restrict their usage to trusted sources only. However, this workaround may impact the functionality of the application and should be considered temporary until the Python.org Python installation can be updated.
You can find more information about this vulnerability, including technical details and the fix, in the official CVE-2019-5010 advisory and the Python.org Python documentation.
Related vulnerabilities
Recent vulnerabilities recorded for python2.
