Description
CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | python2.7 | 2.7.13-4 | — |
| Debian 9 | python3.5 | 3.5.3-1+deb9u1 | DSA-4307-1 |
| Debian 8 | python2.7 | 2.7.9-2+deb8u2 | DLA-1519-1 |
| Debian 8 | python3.4 | 3.4.2-1+deb8u1 | DLA-1520-1 |
| Debian 7 | python2.6 | 2.6.8-1.1+deb7u1 | DLA-1190-1 |
| Debian 7 | python2.7 | 2.7.3-6+deb7u4 | DLA-1189-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | python2.7 | 2.7.12-1ubuntu0~16.04.2 | USN-3496-1 |
| Ubuntu 16.04 LTS | python3.5 | 3.5.2-2ubuntu0~16.04.4 | USN-3496-3 |
| Ubuntu 14.04 LTS | python2.7 | 2.7.6-8ubuntu0.4 | USN-3496-1 |
| Ubuntu 14.04 LTS | python3.4 | 3.4.3-1ubuntu1~14.04.6 | USN-3496-3 |
| Ubuntu 14.04 LTS | python3.5 | 3.5.2-2ubuntu0~16.04.4~14.04.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 SP1 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 15 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 15 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES 12 SP5 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES 12 SP5 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES 12 SP4 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES 12 SP4 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES 12 SP3 | python +1 | 2.7.13-28.3.2 | SUSE-SU-2018:1372-1 |
| SLES 12 SP3 | python-doc | 2.7.13-28.3.3 | SUSE-SU-2018:1372-1 |
| SLES 12 SP3 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES 12 SP3 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES 12 SP2 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES 12 SP1 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES 12 SP1 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES 12 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES 12 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES 11 SP4 | python +1 | 2.6.9-40.3.1 | SUSE-SU-2018:0768-1 |
| SLES 11 SP4 | python-doc | 2.6-8.40.3.1 | SUSE-SU-2018:0768-1 |
| SLES 2 | python | 2.7.17-7.32.2 | SUSE-SU-2020:0234-1 |
| SLES 2 | python-base | 2.7.17-7.32.1 | SUSE-SU-2020:0234-1 |
| SLES for SAP 12 SP5 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES for SAP 12 SP5 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES for SAP 12 SP4 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES for SAP 12 SP4 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES for SAP 12 SP3 | python +1 | 2.7.13-28.3.2 | SUSE-SU-2018:1372-1 |
| SLES for SAP 12 SP3 | python-doc | 2.7.13-28.3.3 | SUSE-SU-2018:1372-1 |
| SLES for SAP 12 SP3 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES for SAP 12 SP3 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES for SAP 12 SP2 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES for SAP 12 SP2 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES for SAP 12 SP1 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SLES for SAP 12 SP1 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SLES for SAP 11 SP4 | python +1 | 2.6.9-40.3.1 | SUSE-SU-2018:0768-1 |
| SLES for SAP 11 SP4 | python-doc | 2.6-8.40.3.1 | SUSE-SU-2018:0768-1 |
| SUSE OpenStack Cloud Crowbar 8 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SUSE OpenStack Cloud Crowbar 8 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SUSE OpenStack Cloud 8 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SUSE OpenStack Cloud 8 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SUSE OpenStack Cloud 7 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SUSE OpenStack Cloud 7 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SUSE HPE Helion OpenStack 8 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SUSE HPE Helion OpenStack 8 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
| SUSE Enterprise Storage 5 | python | 2.7.13-28.3.2 | SUSE-SU-2018:1372-1 |
| SUSE Enterprise Storage 5 | python3 | 3.4.10-25.39.3 | SUSE-SU-2020:0497-1 |
| SUSE Enterprise Storage 5 | python3-base | 3.4.10-25.39.2 | SUSE-SU-2020:0497-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python | 2.7.18-8.1 | openSUSE-SU-2024:11202-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.6 | python2 | 2.7.14-r0 | — |
| Alpine v3.5 | python2 | 2.7.14-r0 | — |
| Alpine v3.4 | python | 2.7.14-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-py | No fix yet | — |
Advisories 12
- USN-3496-3 python3.4, python3.5 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3496-1 python2.7 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4307-1 python3.5 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1520-1 python3.4 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1519-1 python2.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1189-1 python2.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1190-1 python2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:1372-1 Security update for python SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0768-1 Security update for python SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0497-1 Security update for python3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11202-1 python-2.7.18-8.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2020:0234-1 Security update for python SUSE / openSUSE Security Updates · May 2, 2025
References
- [debian-lts-announce] 20171124 [SECURITY] [DLA 1189-1] python2.7 security update mailing-list
- [debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update mailing-list
- https://bugs.python.org/issue30657
- 1039890 vdb-entry
- [debian-lts-announce] 20171124 [SECURITY] [DLA 1190-1] python2.6 security update mailing-list
- DSA-4307 vendor-advisory
- [debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update mailing-list
- GLSA-201805-02 vendor-advisory
- https://security.netapp.com/advisory/ntap-20230216-0001/