Denial-of-Service Vulnerability in Python Packages: CVE-2019-5010
Summary
UBUNTU-CVE-2019-5010: An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. Affects python3.4 versions < 3.4.3-1ubuntu1~14.04.7+esm2. Fixed in 3.4.3-1ubuntu1~14.04.7+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is extensively used in web development, data analysis, artificial intelligence, and more. The affected packages, including python2.7, python3.4, and python3.5, are integral to many applications, providing essential functionalities for executing Python scripts and managing libraries. This vulnerability exposes these packages to potential denial-of-service attacks, impacting applications relying on them.
Vulnerability Detail
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python versions 2.7.11 and 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, leading to a denial of service. Attackers can exploit this vulnerability by initiating or accepting TLS connections using crafted certificates, which may result in application crashes or unavailability.
How To Fix
Minimum fixed version
3.4.3-1ubuntu1~14.04.7+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling TLS connections or validating certificates before establishing connections. This can help mitigate the risk until the packages are updated. However, this may not be a feasible solution for all applications and should be used with caution.
Conclusion
CVE-2019-5010 is a significant denial-of-service vulnerability affecting multiple Python packages. It is crucial to update the affected packages to their patched versions to mitigate the risk of exploitation. Users should remain vigilant and consider using tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for python3.4 →
FAQ
CVE-2019-5010 is a denial-of-service vulnerability in the X509 certificate parser of specific Python versions, which can be exploited using specially crafted certificates.
If your application uses the affected Python packages, it may crash or become unavailable when processing malicious X509 certificates.
The affected versions include Python 2.7.11, Python 3.4.3, and Python 3.5.2, among others.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
The CVSS score for CVE-2019-5010 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
