{"id":"USN-4127-2","summary":"python2.7, python3.4 vulnerabilities","details":"USN-4127-1 fixed several vulnerabilities in Python. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Python incorrectly handled certain pickle files. An\n attacker could possibly use this issue to consume memory, leading to a\n denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-20406)\n\n It was discovered that Python incorrectly validated the domain when\n handling cookies. An attacker could possibly trick Python into sending\n cookies to the wrong domain. (CVE-2018-20852)\n\n Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly\n handled Unicode encoding during NFKC normalization. An attacker could\n possibly use this issue to obtain sensitive information. (CVE-2019-9636,\n CVE-2019-10160)\n\n Colin Read and Nicolas Edet discovered that Python incorrectly handled\n parsing certain X509 certificates. An attacker could possibly use this\n issue to cause Python to crash, resulting in a denial of service. This\n issue only affected Ubuntu 14.04 ESM. (CVE-2019-5010)\n\n It was discovered that Python incorrectly handled certain urls. A remote\n attacker could possibly use this issue to perform CRLF injection attacks.\n (CVE-2019-9740, CVE-2019-9947)\n\n Sihoon Lee discovered that Python incorrectly handled the local_file:\n scheme. A remote attacker could possibly use this issue to bypass blocklist\n meschanisms. (CVE-2019-9948)\n","modified":"2026-02-10T04:41:38Z","published":"2019-09-10T13:08:17Z","related":["UBUNTU-CVE-2018-20406","UBUNTU-CVE-2018-20852","UBUNTU-CVE-2019-10160","UBUNTU-CVE-2019-5010","UBUNTU-CVE-2019-9636","UBUNTU-CVE-2019-9740","UBUNTU-CVE-2019-9947","UBUNTU-CVE-2019-9948"],"upstream":["CVE-2018-20406","CVE-2018-20852","CVE-2019-10160","CVE-2019-5010","CVE-2019-9636","CVE-2019-9740","CVE-2019-9947","CVE-2019-9948","UBUNTU-CVE-2018-20406","UBUNTU-CVE-2018-20852","UBUNTU-CVE-2019-10160","UBUNTU-CVE-2019-5010","UBUNTU-CVE-2019-9636","UBUNTU-CVE-2019-9740","UBUNTU-CVE-2019-9947","UBUNTU-CVE-2019-9948"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-4127-2"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-20406"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-20852"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-5010"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-9636"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-9740"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-9947"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-9948"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-10160"}],"affected":[{"package":{"name":"python2.7","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/python2.7@2.7.6-8ubuntu0.6+esm2?arch=source&distro=trusty/esm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.6+esm2"}]}],"versions":["2.7.5-8ubuntu3","2.7.5-8ubuntu4","2.7.6-2","2.7.6-2ubuntu1","2.7.6-3","2.7.6-3ubuntu1","2.7.6-4","2.7.6-4ubuntu1","2.7.6-5","2.7.6-7","2.7.6-8","2.7.6-8ubuntu0.2","2.7.6-8ubuntu0.3","2.7.6-8ubuntu0.4","2.7.6-8ubuntu0.5"],"ecosystem_specific":{"binaries":[{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"idle-python2.7"},{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"libpython2.7"},{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"libpython2.7-dev"},{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"libpython2.7-minimal"},{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"libpython2.7-stdlib"},{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"libpython2.7-testsuite"},{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"python2.7"},{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"python2.7-dev"},{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"python2.7-examples"},{"binary_version":"2.7.6-8ubuntu0.6+esm2","binary_name":"python2.7-minimal"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-4127-2.json","cves_map":{"cves":[{"id":"CVE-2018-20406","severity":[{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2018-20852","severity":[{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-5010","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2019-9636","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-9740","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-9947","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-9948","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-10160","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:Pro:14.04:LTS"}}},{"package":{"name":"python3.4","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.7+esm2?arch=source&distro=trusty/esm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1ubuntu1~14.04.7+esm2"}]}],"versions":["3.4~b1-0ubuntu3","3.4~b1-4ubuntu4","3.4~b1-4ubuntu6","3.4~b1-5ubuntu2","3.4~b2-1","3.4~b3-1ubuntu1","3.4~rc1-1build1","3.4~rc2-1","3.4~rc3-0ubuntu1","3.4.0-1","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.3-1ubuntu1~14.04.1","3.4.3-1ubuntu1~14.04.3","3.4.3-1ubuntu1~14.04.4","3.4.3-1ubuntu1~14.04.5","3.4.3-1ubuntu1~14.04.6","3.4.3-1ubuntu1~14.04.7"],"ecosystem_specific":{"binaries":[{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"idle-python3.4"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"libpython3.4"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"libpython3.4-dev"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"libpython3.4-minimal"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"libpython3.4-stdlib"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"libpython3.4-testsuite"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"python3.4"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"python3.4-dev"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"python3.4-examples"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"python3.4-minimal"},{"binary_version":"3.4.3-1ubuntu1~14.04.7+esm2","binary_name":"python3.4-venv"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-4127-2.json","cves_map":{"cves":[{"id":"CVE-2018-20406","severity":[{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2018-20852","severity":[{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-5010","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2019-9636","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-9740","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-9947","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-9948","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2019-10160","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:Pro:14.04:LTS"}}}],"schema_version":"1.7.3"}