USN-4754-1 — python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities

Summary

It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)

Fixed packages 7

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	python2.7	2.7.12-1ubuntu0~16.04.14
Ubuntu · 16.04 LTS 16.04:LTS	python3.5	3.5.2-2ubuntu0~16.04.13
Ubuntu · 18.04 LTS 18.04:LTS	python2.7	2.7.17-1~18.04ubuntu1.3
Ubuntu · 18.04 LTS 18.04:LTS	python3.6	3.6.9-1~18.04ubuntu1.4
Ubuntu · 20.04 LTS 20.04:LTS	python3.8	3.8.5-1~20.04.2
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	python2.7	2.7.6-8ubuntu0.6+esm8
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	python3.4	3.4.3-1ubuntu1~14.04.7+esm10

Vulnerabilities 2

Critical 9.8

CVE-2021-3177 EPSS 24%

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code exec…

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine

Jan 19, 2021
Unscored —

CVE-2020-27619

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via …

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu

Oct 22, 2020

References

report
https://ubuntu.com/security/CVE-2020-27619
report
https://ubuntu.com/security/CVE-2021-3177

python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities

Summary

Fixed packages 7

Vulnerabilities 2

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code exec…

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via …

References