SB2019102516 - Multiple vulnerabilities in Python

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019102516

SB2019102516 - Multiple vulnerabilities in Python

Published: October 25, 2019 Updated: June 3, 2025

Security Bulletin ID SB2019102516
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Race condition (CVE-ID: CVE-2010-3493)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, or the getpeername function having an ENOTCONN error, a related issue to CVE-2010-3492.


2) Input validation error (CVE-ID: CVE-2010-1634)

The vulnerability allows context-dependent attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (application crash) via a large fragment, as demonstrated by a call to audioop.lin2lin with a long string in the first argument, leading to a buffer overflow.


Remediation

Install update from vendor's website.

References