Home / mailings

PDF

[USN-1615-1] Python 3.2 vulnerabilities

Posted on 23 October 2012
Ubuntu Security

==========================
==========================
========================
Ubuntu Security Notice USN-1615-1
October 23, 2012

python3.2 vulnerabilities
==========================
==========================
========================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04

Summary:

Several security issues were fixed in Python 3.2.

Software Description:
- python3.2: Interactive high-level object-oriented language (version 3.2=
)

Details:

It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker could exploit this to obtai=
n
sensitive information. (CVE-2011-4944)

It was discovered that SimpleXMLRPCServer did not properly validate its
input when handling HTTP POST requests. A remote attacker could exploit
this to cause a denial of service via excessive CPU utilization. This iss=
ue
only affected Ubuntu 11.04 and 11.10. (CVE-2012-0845)

It was discovered that Python was susceptible to hash algorithm attacks.
An attacker could cause a denial of service under certian circumstances.
This updates adds the '-R' command line option and honors setting the
PYTHONHASHSEED environment variable to 'random' to salt str and datetime
objects with an unpredictable value. This issue only affected Ubuntu 11.0=
4
and 11.10. (CVE-2012-1150)

Serhiy Storchaka discovered that the UTF16 decoder in Python did not
properly reset internal variables after error handling. An attacker could=

exploit this to cause a denial of service via memory corruption. This iss=
ue
did not affect Ubuntu 12.10. (CVE-2012-2135)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
python3.2 3.2.3-6ubuntu3.1
python3.2-minimal 3.2.3-6ubuntu3.1

Ubuntu 12.04 LTS:
python3.2 3.2.3-0ubuntu3.2
python3.2-minimal 3.2.3-0ubuntu3.2

Ubuntu 11.10:
python3.2 3.2.2-0ubuntu1.1
python3.2-minimal 3.2.2-0ubuntu1.1

Ubuntu 11.04:
python3.2 3.2-1ubuntu1.2
python3.2-minimal 3.2-1ubuntu1.2

In general, a standard system update will make all the necessary changes.=


References:
http://www.ubuntu.com/usn/usn-1615-1
CVE-2011-4944, CVE-2012-0845, CVE-2012-1150, CVE-2012-2135

Package Information:
https://launchpad.net/ubuntu/+source/python3.2/3.2.3-6ubuntu3.1
https://launchpad.net/ubuntu/+source/python3.2/3.2.3-0ubuntu3.2
https://launchpad.net/ubuntu/+source/python3.2/3.2.2-0ubuntu1.1
https://launchpad.net/ubuntu/+source/python3.2/3.2-1ubuntu1.2





------------

 

TOP