Critical Vulnerabilities in Python Packages: python2.7, python3.4, python3.5, python3.6, python3.8
Summary
USN-5342-1: python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities. Affects python3.4 versions < 3.4.3-1ubuntu1~14.04.7+esm12. Fixed in 3.4.3-1ubuntu1~14.04.7+esm12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is commonly used for web development, data analysis, artificial intelligence, and more. The specific versions of Python mentioned are part of various Ubuntu distributions, which are critical for running applications and scripts. However, these versions have been found to contain vulnerabilities that could lead to serious security issues.
Vulnerability Detail
Several vulnerabilities have been identified in the Python packages, including improper handling of inputs and FTP requests. These vulnerabilities could allow attackers to expose sensitive information or execute arbitrary code. Specifically, CVE-2021-3426 and CVE-2021-4189 affect Ubuntu 18.04 LTS, while CVE-2022-0391 poses a risk across multiple versions. The vulnerabilities stem from flaws in the Python code that fail to validate inputs correctly, leading to potential exploitation.
How To Fix
Minimum fixed version
3.4.3-1ubuntu1~14.04.7+esm12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the affected Python applications or using alternative versions of Python that do not contain these vulnerabilities until a proper fix can be applied.
Conclusion
The identified vulnerabilities in Python packages pose significant risks to applications running on affected Ubuntu versions. It is crucial to update to the patched versions as soon as possible to mitigate these risks and ensure the security of your systems.
See every vulnerability recorded for python3.4 →
FAQ
The vulnerabilities include improper input handling and FTP request processing, which could lead to information exposure and arbitrary code execution.
The vulnerabilities affect Ubuntu 14.04 ESM, 16.04 ESM, and 18.04 LTS.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Consider implementing access restrictions to the affected applications or using alternative Python versions until you can apply the necessary updates.
While specific exploits may not be publicly available, the vulnerabilities could potentially be exploited by attackers to gain unauthorized access or execute malicious code.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
