Packages
Details
It was discovered that Python incorrectly handled certain pickle files. An
attacker could possibly use this issue to consume memory, leading to a
denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when
handling cookies. An attacker could possibly trick Python into sending
cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly
handled Unicode encoding during NFKC normalization. An attacker could
possibly use this issue to obtain sensitive information. (CVE-2019-9636,
CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled
parsing certain X509 certificates. An...
It was discovered that Python incorrectly handled certain pickle files. An
attacker could possibly use this issue to consume memory, leading to a
denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when
handling cookies. An attacker could possibly trick Python into sending
cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly
handled Unicode encoding during NFKC normalization. An attacker could
possibly use this issue to obtain sensitive information. (CVE-2019-9636,
CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled
parsing certain X509 certificates. An attacker could possibly use this
issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010)
It was discovered that Python incorrectly handled certain urls. A remote
attacker could possibly use this issue to perform CRLF injection attacks.
(CVE-2019-9740, CVE-2019-9947)
Sihoon Lee discovered that Python incorrectly handled the local_file:
scheme. A remote attacker could possibly use this issue to bypass blocklist
meschanisms. (CVE-2019-9948)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 19.04 disco | python2.7 – 2.7.16-2ubuntu0.1 | ||
| python2.7-minimal – 2.7.16-2ubuntu0.1 | |||
| python3.7 – 3.7.3-2ubuntu0.1 | |||
| python3.7-minimal – 3.7.3-2ubuntu0.1 | |||
| 18.04 bionic | python2.7 – 2.7.15-4ubuntu4~18.04.1 | ||
| python2.7-minimal – 2.7.15-4ubuntu4~18.04.1 | |||
| python3.6 – 3.6.8-1~18.04.2 | |||
| python3.6-minimal – 3.6.8-1~18.04.2 | |||
| 16.04 xenial | python2.7 – 2.7.12-1ubuntu0~16.04.8 | ||
| python2.7-minimal – 2.7.12-1ubuntu0~16.04.8 | |||
| python3.5 – 3.5.2-2ubuntu0~16.04.8 | |||
| python3.5-minimal – 3.5.2-2ubuntu0~16.04.8 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.