Skip to content
OpenAdvisories
Unscored Rejected CVE-2013-1752 EUVD-2013-1779

Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service (memory cons…

Published Jun 3, 2019 · Assigned by mitre

Package: python2.7 Ecosystem: Ubuntu

Description

Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service (memory consumption) via a long string, related to (1) httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; (2) ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; (3) imaplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; (4) nntplib - fixed in 2.7.6, 2.6.9, 3.3.3; (5) poplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; and (6) smtplib - not yet fixed in 2.7.x, fixed in 2.6.9, not yet fixed in 3.3.x. NOTE: this was REJECTed because it is incompatible with CNT1 "Independently Fixable" in the CVE Counting Decisions

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS python2.7 2.7.6-8ubuntu0.2 USN-2653-1
Ubuntu 14.04 LTS python3.4 3.4.0-2ubuntu1.1 USN-2653-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 python +6 2.7.5-34.el7 RHSA-2015:2101
RHEL 6 python +5 2.6.6-64.el6 RHSA-2015:1330
RHEL 2 python27 +2 1.1-17.el6 RHSA-2015:1064
RHEL 2 python27-python +6 2.7.8-3.el6 RHSA-2015:1064
RHEL 2 python27-python-pip 1.5.6-5.el6 RHSA-2015:1064
RHEL 2 python27-python-setuptools 0.9.8-3.el6 RHSA-2015:1064
RHEL 2 python27-python-simplejson 3.2.0-2.el6 RHSA-2015:1064
RHEL 2 python27-python-wheel 0.24.0-2.el6 RHSA-2015:1064

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP1 python 2.7.17-7.32.2 SUSE-SU-2020:0234-1
SLES 15 SP1 python-base 2.7.17-7.32.1 SUSE-SU-2020:0234-1
SLES 15 SP1 python3 +1 3.6.10-3.42.2 SUSE-SU-2020:0114-1
SLES 15 python 2.7.17-7.32.2 SUSE-SU-2020:0234-1
SLES 15 python-base 2.7.17-7.32.1 SUSE-SU-2020:0234-1
SLES 15 python3 +1 3.6.10-3.42.2 SUSE-SU-2020:0114-1
SLES 12 python +1 2.7.9-14.1 SUSE-SU-2015:1344-1
SLES 12 python-doc 2.7.9-14.3 SUSE-SU-2015:1344-1
SLES 2 python 2.7.17-7.32.2 SUSE-SU-2020:0234-1
SLES 2 python-base 2.7.17-7.32.1 SUSE-SU-2020:0234-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 python +1 2.7.9-14.1 SUSE-SU-2015:1344-1
SLES for SAP 12 python-doc 2.7.9-14.3 SUSE-SU-2015:1344-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python 2.7.18-8.1 openSUSE-SU-2024:11202-1
openSUSE Tumbleweed python-base 2.7.12-1.4 openSUSE-SU-2024:10536-1
openSUSE Tumbleweed python310 3.10.0rc1-4.2 openSUSE-SU-2024:11283-1
openSUSE Tumbleweed python311 3.11.0b1-1.1 openSUSE-SU-2024:12089-1
openSUSE Tumbleweed python312 3.12.0a7-1.1 openSUSE-SU-2024:12910-1
openSUSE Tumbleweed python313 3.13.0~b3-1.1 openSUSE-SU-2024:14109-1
openSUSE Tumbleweed python314 3.14.0~a1-1.1 openSUSE-SU-2024:14434-1
openSUSE Tumbleweed python315 3.15.0~a1-1.1 openSUSE-SU-2025:15713-1
openSUSE Tumbleweed python36 3.6.15-1.1 openSUSE-SU-2024:11284-1
openSUSE Tumbleweed python38 3.8.12-1.2 openSUSE-SU-2024:11285-1
openSUSE Tumbleweed python39 3.9.7-2.1 openSUSE-SU-2024:11286-1
openSUSE Leap 15.1 python3 +1 3.6.10-lp151.6.7.1 openSUSE-SU-2020:0086-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 python +6 2.7.5-34.0.1.el7 ELSA-2015-2101
Oracle Linux 7 python27 +2 1.1-20.el7 ELSA-2015-1064
Oracle Linux 7 python27-python +6 2.7.8-3.el7 ELSA-2015-1064
Oracle Linux 7 python27-python-pip 1.5.6-5.el7 ELSA-2015-1064
Oracle Linux 7 python27-python-setuptools 0.9.8-5.el7 ELSA-2015-1064
Oracle Linux 7 python27-python-simplejson 3.2.0-3.el7 ELSA-2015-1064
Oracle Linux 7 python27-python-wheel 0.24.0-2.el7 ELSA-2015-1064

Advisories 22