SB2020072233 - Ubuntu update for python2.7

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2019-17514)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.

2) Infinite loop (CVE-ID: CVE-2019-20907)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop In Lib/tarfile.py in Python. A remote attacker can create a specially crafted TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

3) Resource exhaustion (CVE-ID: CVE-2019-9674)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Lib/zipfile.py in Python when processing ZIP archives. A remote attacker can pass a specially crafted .zip archive to the application, trigger resource exhaustion and perform a denial of service (DoS) attack.

4) Resource exhaustion (CVE-ID: CVE-2020-14422)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application improperly computes hash values in the IPv4Interface and IPv6Interface classes within the Lib/ipaddress.py in Python. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-4428-1