Your submission was sent successfully! Close

You have successfully unsubscribed! Close

USN-1314-1: Python 3 vulnerabilities

19 December 2011

Applications using certain Python 3 modules could be made to crash or expose sensitive information over the network.

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Releases

Packages

  • python3.1 - An interactive high-level object-oriented language (version 3.1)
  • python3.2 - An interactive high-level object-oriented language (version 3.2)

Details

Giampaolo Rodola discovered that the smtpd module in Python 3 did not
properly handle certain error conditions. A remote attacker could exploit
this to cause a denial of service via daemon outage. This issue only
affected Ubuntu 10.04 LTS. (CVE-2010-3493)

Niels Heinen discovered that the urllib module in Python 3 would process
Location headers that specify a file:// URL. A remote attacker could use
this to obtain sensitive information or cause a denial of service via
resource consumption. (CVE-2011-1521)

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 11.04
Ubuntu 10.10
Ubuntu 10.04

In general, a standard system update will make all the necessary changes.
Daemons using the urllib or smtpd modules may also need to be restarted
after a pplying this update.

Related notices