SB2019040835 - Fedora EPEL 6 update for python34 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019040835

SB2019040835 - Fedora EPEL 6 update for python34

Published: April 8, 2019 Updated: April 24, 2025

Security Bulletin ID SB2019040835
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) XXE attack (CVE-ID: CVE-2018-14647)

The vulnerability allows a remote attacker to conduct XXE-attack.

The vulnerability exists due to improper handling of XML External Entities (XXEs) when parsing an XML file. A remote attacker can trick the victim into open an XML file that submits malicious input, trigger pathological hash collisions in Expat's internal data structures, consume large amounts CPU and RAM, and cause a denial of service (DoS) condition.


2) Integer overflow (CVE-ID: CVE-2018-20406)

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to integer overflow in modules/_pickle.c when processing a large LONG_BINPUT value during the "resize to twice the size" attempt. A remote attacker can supply overly large data, trigger integer overflow and exhaust all resources on the system.


3) Improper input validation (CVE-ID: CVE-2018-1060)

The vulnerability allows a remote attacker to cause DoS condition on he target system.

The weakness exists due to the way catastrophic backtracking was implemented in apop() method in pop3lib. A remote attacker can cause the service to crash.

4) NULL pointer dereference (CVE-ID: CVE-2019-5010)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the X509 certificate parser of the affected software improperly handles X509 certificates with a certificate extension that uses a Certificate Revocation List (CRL) distribution point with empty distributionPoint and cRLIssuer fields. A remote attacker can send a request to initiate a Transport Layer Security (TLS) connection using an X509 certificate that submits malicious input, trigger a NULL pointer dereference condition that causes the application to crash, resulting in a DoS condition.


Remediation

Install update from vendor's website.

References