Denial of Service Vulnerability in Python Package: python3.x
Summary
UBUNTU-CVE-2020-14422: Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by t... Affects python3.4 versions < 3.4.3-1ubuntu1~14.04.7+esm7. Fixed in 3.4.3-1ubuntu1~14.04.7+esm7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python package, specifically versions 3.4, 3.5, 3.6, 3.7, and 3.8, is a widely used programming language that supports multiple programming paradigms, including procedural, object-oriented, and functional programming. It is known for its simplicity and readability, making it a popular choice among developers. However, a vulnerability has been identified in the ipaddress.py module, which can lead to denial of service under certain conditions.
Vulnerability Detail
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes. This flaw may allow a remote attacker to exploit applications that utilize these classes, potentially leading to a denial of service by causing excessive dictionary entries to be created, which can degrade performance significantly.
How To Fix
Minimum fixed version
3.4.3-1ubuntu1~14.04.7+esm7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider limiting the exposure of applications that utilize the affected Python versions to untrusted inputs. Additionally, monitoring and rate-limiting incoming requests may help mitigate the impact of potential denial of service attacks.
Conclusion
In summary, a denial of service vulnerability has been identified in the Python package, specifically in the ipaddress.py module. It is crucial to update the affected packages to their patched versions to mitigate the risk. Users should also consider implementing workarounds to protect their applications until updates can be applied.
See every vulnerability recorded for python3.4 →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a medium severity level.
The vulnerability affects Python versions 3.4, 3.5, 3.6, 3.7, and 3.8.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to a denial of service, where an attacker can degrade the performance of applications by creating excessive dictionary entries.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
