SB2019031925 - Fedora 30 update for python34

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2019-9636)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input when processing data in Unicode encoding with an incorrect netloc during NFKC normalization. A remote attacker can gain access to sensitive information.

2) NULL pointer dereference (CVE-ID: CVE-2019-5010)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the X509 certificate parser of the affected software improperly handles X509 certificates with a certificate extension that uses a Certificate Revocation List (CRL) distribution point with empty distributionPoint and cRLIssuer fields. A remote attacker can send a request to initiate a Transport Layer Security (TLS) connection using an X509 certificate that submits malicious input, trigger a NULL pointer dereference condition that causes the application to crash, resulting in a DoS condition.

3) Integer overflow (CVE-ID: CVE-2018-20406)

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to integer overflow in modules/_pickle.c when processing a large LONG_BINPUT value during the "resize to twice the size" attempt. A remote attacker can supply overly large data, trigger integer overflow and exhaust all resources on the system.

4) Improper input validation (CVE-ID: CVE-2018-1060)

The vulnerability allows a remote attacker to cause DoS condition on he target system.

The weakness exists due to the way catastrophic backtracking was implemented in apop() method in pop3lib. A remote attacker can cause the service to crash.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2019-7d9f3cf3ce