Skip to content
OpenAdvisories
Medium ALAS2-2018-1132 1 CVE

Moderate: python3 security update (Amazon Linux 2)

Published Dec 17, 2018 · Updated Dec 19, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-14647: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. 1631822: CVE-2018-14647 python: Missing salt initialization in _elementtree.c module

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python3 0:3.7.1-9.amzn2.0.1
Amazon Linux · 2 python3-debug 0:3.7.1-9.amzn2.0.1
Amazon Linux · 2 python3-debuginfo 0:3.7.1-9.amzn2.0.1
Amazon Linux · 2 python3-devel 0:3.7.1-9.amzn2.0.1
Amazon Linux · 2 python3-libs 0:3.7.1-9.amzn2.0.1
Amazon Linux · 2 python3-test 0:3.7.1-9.amzn2.0.1
Amazon Linux · 2 python3-tkinter 0:3.7.1-9.amzn2.0.1
Amazon Linux · 2 python3-tools 0:3.7.1-9.amzn2.0.1

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-14647.html