Description
Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | python2.4 | 2.4.6-1+lenny1 | DSA-1977-1 |
| Debian 5.0 | python2.5 | 2.5.2-6+lenny1 | DTSA-157-1, DSA-1977-1 |
| Debian 4.0 | python2.4 | 2.4.4-3+etch3 | DSA-1977-1 |
| Debian 4.0 | python2.5 | 2.5-5+etch2 | DSA-1977-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 2 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 2 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python | 2.7.18-8.1 | openSUSE-SU-2024:11202-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Advisories 4
- DSA-1977-1 python - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-157-1 python2.5 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11202-1 python-2.7.18-8.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2020:0234-1 Security update for python SUSE / openSUSE Security Updates · May 2, 2025
References
- 20080813 rPSA-2008-0243-1 idle python mailing-list
- SUSE-SR:2008:017 vendor-advisory
- ADV-2008-2288 vdb-entry
- python-multiple-bo(44173) vdb-entry
- 30491 vdb-entry
- 33937 third-party-advisory
- 31687 third-party-advisory
- GLSA-200807-16 vendor-advisory
- http://support.apple.com/kb/HT3438
- APPLE-SA-2009-02-12 vendor-advisory
- 31358 third-party-advisory
- 31332 third-party-advisory
- USN-632-1 vendor-advisory
- 31518 third-party-advisory
- python-hashlib-overflow(44174) vdb-entry
- 31305 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=230640
- 31365 third-party-advisory
- http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5032900
- 31473 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0243
- MDVSA-2008:163 vendor-advisory
- SSA:2008-217-01 vendor-advisory
- http://bugs.gentoo.org/attachment.cgi?id=159422&action=view