Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]
- Ubuntu Security Notice USN-5960-1[6]
- Authored by Ubuntu[7] | Site security.ubuntu.com[8]
-
Ubuntu Security Notice 5960-1 - Yebo Cao discovered that Python incorrectly handled certain URLs. An attacker could possibly use this issue to bypass blocklisting methods by supplying a URL that starts with blank characters.
- systems | linux[9], ubuntu[10]
- advisories | CVE-2023-24329[11]
- SHA-256 |
727432be8aaebcbbf1e8da1308a8110c3c6dc6fb3ff312a8e8e10aae1adc194b
- Download[12] | Favorite[13] | View[14]
Change Mirror[15] Download[16]
==========================================================================
Ubuntu Security Notice USN-5960-1
March 16, 2023
python2.7, python3.10, python3.5, python3.6, python3.8 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM
Summary:
Python could be made to bypass blocklisting methods if a specially
crafted URL was provided.
Software Description:
- python3.10: An interactive high-level object-oriented language
- python3.8: An interactive high-level object-oriented language
- python2.7: An interactive high-level object-oriented language
- python3.6: An interactive high-level object-oriented language
- python3.5: An interactive high-level object-oriented language
Details:
Yebo Cao discovered that Python incorrectly handled certain URLs.
An attacker could possibly use this issue to bypass blocklisting
methods by supplying a URL that starts with blank characters.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.10:
python3.10 3.10.7-1ubuntu0.3
Ubuntu 22.04 LTS:
python3.10 3.10.6-1~22.04.2ubuntu1
Ubuntu 20.04 LTS:
python3.8 3.8.10-0ubuntu1~20.04.7
Ubuntu 18.04 LTS:
python2.7 2.7.17-1~18.04ubuntu1.11
python3.6 3.6.9-1~18.04ubuntu1.12
Ubuntu 16.04 ESM:
python2.7 2.7.12-1ubuntu0~16.04.18+esm4
python3.5 3.5.2-2ubuntu0~16.04.13+esm7
Ubuntu 14.04 ESM:
python2.7 2.7.6-8ubuntu0.6+esm14
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5960-1
CVE-2023-24329
Package Information:
https://launchpad.net/ubuntu/+source/python3.10/3.10.7-1ubuntu0.3
https://launchpad.net/ubuntu/+source/python3.10/3.10.6-1~22.04.2ubuntu1
https://launchpad.net/ubuntu/+source/python3.8/3.8.10-0ubuntu1~20.04.7
https://launchpad.net/ubuntu/+source/python2.7/2.7.17-1~18.04ubuntu1.11
https://launchpad.net/ubuntu/+source/python3.6/3.6.9-1~18.04ubuntu1.12
File Tags
- ActiveX[22] (932)
- Advisory[23] (80,514)
- Arbitrary[24] (15,906)
- BBS[25] (2,859)
- Bypass[26] (1,648)
- CGI[27] (1,020)
- Code Execution[28] (7,023)
- Conference[29] (676)
- Cracker[30] (840)
- CSRF[31] (3,305)
- DoS[32] (22,907)
- Encryption[33] (2,358)
- Exploit[34] (50,646)
- File Inclusion[35] (4,177)
- File Upload[36] (950)
- Firewall[37] (821)
- Info Disclosure[38] (2,685)
- Intrusion Detection[39] (876)
- Java[40] (2,957)
- JavaScript[41] (830)
- Kernel[42] (6,436)
- Local[43] (14,287)
- Magazine[44] (586)
- Overflow[45] (12,529)
- Perl[46] (1,419)
- PHP[47] (5,110)
- Proof of Concept[48] (2,297)
- Protocol[49] (3,492)
- Python[50] (1,486)
- Remote[51] (30,249)
- Root[52] (3,530)
- Rootkit[53] (502)
- Ruby[54] (601)
- Scanner[55] (1,633)
- Security Tool[56] (7,821)
- Shell[57] (3,129)
- Shellcode[58] (1,206)
- Sniffer[59] (890)
- Spoof[60] (2,181)
- SQL Injection[61] (16,162)
- TCP[62] (2,383)
- Trojan[63] (687)
- UDP[64] (880)
- Virus[65] (663)
- Vulnerability[66] (31,350)
- Web[67] (9,451)
- Whitepaper[68] (3,739)
- x86[69] (946)
- XSS[70] (17,564)
- Other[71]
File Archives
- March 2023[72]
- February 2023[73]
- January 2023[74]
- December 2022[75]
- November 2022[76]
- October 2022[77]
- September 2022[78]
- August 2022[79]
- July 2022[80]
- June 2022[81]
- May 2022[82]
- April 2022[83]
- Older[84]
Systems
- AIX[85] (426)
- Apple[86] (1,951)
- BSD[87] (370)
- CentOS[88] (55)
- Cisco[89] (1,919)
- Debian[90] (6,710)
- Fedora[91] (1,691)
- FreeBSD[92] (1,242)
- Gentoo[93] (4,288)
- HPUX[94] (878)
- iOS[95] (338)
- iPhone[96] (108)
- IRIX[97] (220)
- Juniper[98] (67)
- Linux[99] (45,054)
- Mac OS X[100] (684)
- Mandriva[101] (3,105)
- NetBSD[102] (256)
- OpenBSD[103] (482)
- RedHat[104] (12,874)
- Slackware[105] (941)
- Solaris[106] (1,609)
- SUSE[107] (1,444)
- Ubuntu[108] (8,426)
- UNIX[109] (9,205)
- UnixWare[110] (185)
- Windows[111] (6,530)
- Other[112]
- Services
- Security Services[123]
- Hosting By
- Rokasec[124]
Read more https://packetstormsecurity.com/files/171405/USN-5960-1.txt