Summary
USN-7015-1 fixed several vulnerabilities in Python. This update provides
one of the corresponding updates for python2.7 for Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and a second for
python3.5 for Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that Python allowed excessive backtracking while
parsing certain tarfile headers. A remote attacker could possibly use
this issue to cause Python to consume resources, leading to a denial
of service. This issue only affected python3.5 for
Ubuntu 16.04 LTS (CVE-2024-6232)
It was discovered that the Python http.cookies module incorrectly
handled parsing cookies that contained backslashes for quoted
characters. A remote attacker could possibly use this issue to cause
Python to consume resources, leading to a denial of service.
(CVE-2024-7592)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python2.7 | 2.7.12-1ubuntu0~16.04.18+esm10 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm14 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python2.7 | 2.7.17-1~18.04ubuntu1.13+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python2.7 | 2.7.18-1~20.04.4+esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python2.7 | 2.7.18-13ubuntu1.2+esm2 |
Vulnerabilities 2
-
High 7.5CVE-2024-6232 Public exploit
Regular-expression DoS when parsing TarFile headers
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
-
High 7.5
Quadratic complexity parsing cookies with backslashes
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic compl…