Security Update for python2.7
Summary
DLA-522-1: python2.7 - security update. Affects python2.7 versions < 2.7.3-6+deb7u3. Fixed in 2.7.3-6+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 2.7 is an open-source programming language widely used for various applications. It provides a comprehensive standard library and supports multiple programming paradigms. However, the python2.7 package in Debian 7 Wheezy is vulnerable to multiple security issues.
Vulnerability Detail
The python2.7 package in Debian 7 Wheezy is affected by three vulnerabilities:
-
CVE-2016-0772: This vulnerability allows a Man-in-the-Middle (MITM) attacker to perform a startTLS stripping attack. The smtplib module in python2.7 does not raise an exception when the remote end (SMTP server) fails to respond with 220 (ok) to an explicit call of SMTP.starttls(). This can be exploited by a malicious MITM to perform a startTLS stripping attack.
-
CVE-2016-5636: This vulnerability can lead to an integer overflow and heap corruption in zipimporter.get_data(). It could potentially be exploited to execute arbitrary code or cause a denial of service.
-
CVE-2016-5699: This vulnerability allows for protocol injection if an application sets a header based on user-supplied values or tries to fetch a URL specified by an attacker (Server-Side Request Forgery - SSRF case) or accesses a malicious web server (redirection case).
How To Fix
Minimum fixed version
2.7.3-6+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the python2.7 package to version 2.7.3-6+deb7u3 or later is crucial to address these vulnerabilities. It is recommended to follow the provided fix instructions and apply the necessary updates. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python2.7 →
FAQ
The impact of CVE-2016-0772 is that a Man-in-the-Middle attacker can perform a startTLS stripping attack, potentially compromising the confidentiality and integrity of communication between the client and the SMTP server.
CVE-2016-5636 can be exploited by triggering an integer overflow and heap corruption in zipimporter.get_data(). This could lead to arbitrary code execution or denial of service.
CVE-2016-5699 poses a risk of protocol injection, allowing an attacker to manipulate the application's behavior by setting headers or redirecting requests to malicious servers.
No specific workarounds are mentioned in the advisory. It is recommended to upgrade to the fixed version of the python2.7 package.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
