Summary
It was discovered that Python incorrectly handled certain plist files.
If a user or an automated system were tricked into processing a specially
crafted plist file, an attacker could possibly use this issue to consume
resources, resulting in a denial of service. (CVE-2022-48564)
It was discovered that Python instances of ssl.SSLSocket were vulnerable
to a bypass of the TLS handshake. An attacker could possibly use this
issue to cause applications to treat unauthenticated received data before
TLS handshake as authenticated data after TLS handshake. (CVE-2023-40217)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python2.7 | 2.7.6-8ubuntu0.6+esm18 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python2.7 | 2.7.12-1ubuntu0~16.04.18+esm9 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm12 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python2.7 | 2.7.17-1~18.04ubuntu1.13+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.6 | 3.6.9-1~18.04ubuntu1.13+esm1 |
Vulnerabilities 2
-
Unscored —
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion whe…
-
Unscored —
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. …