Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."

This update for python fixes the following issues :

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 5.04, has python packages installed that are affected by multiple vulnerabilities:

  - Multiple integer overflows in the imageop module in     Python 2.5.1 and earlier allow context-dependent     attackers to cause a denial of service (application     crash) and possibly obtain sensitive information (memory     contents) via crafted arguments to (1) the tovideo     method, and unspecified other vectors related to (2)     imageop.c, (3) rbgimgmodule.c, and other files, which     trigger heap-based buffer overflows. (CVE-2007-4965)

  - Integer overflow in _hashopenssl.c in the hashlib module     in Python 2.5.2 and earlier might allow context-     dependent attackers to defeat cryptographic digests,     related to partial hashlib hashing of data exceeding     4GB. (CVE-2008-2316)

  - Untrusted search path vulnerability in the PySys_SetArgv     API function in Python 2.6 and earlier, and possibly     later versions, prepends an empty string to sys.path     when the argv[0] argument does not contain a path     separator, which might allow local users to execute     arbitrary code via a Trojan horse Python file in the     current working directory. (CVE-2008-5983)

  - Multiple integer overflows in audioop.c in the audioop     module in Python 2.6, 2.7, 3.1, and 3.2 allow context-     dependent attackers to cause a denial of service     (application crash) via a large fragment, as     demonstrated by a call to audioop.lin2lin with a long     string in the first argument, leading to a buffer     overflow. NOTE: this vulnerability exists because of an     incorrect fix for CVE-2008-3143.5. (CVE-2010-1634)

  - The audioop module in Python 2.7 and 3.2 does not verify     the relationships between size arguments and byte string     lengths, which allows context-dependent attackers to     cause a denial of service (memory corruption and     application crash) via crafted arguments, as     demonstrated by a call to audioop.reverse with a one-     byte string, a different vulnerability than     CVE-2010-1634. (CVE-2010-2089)

  - The ssl.match_hostname function in the SSL module in     Python 2.6 through 3.4 does not properly handle a '\0'     character in a domain name in the Subject Alternative     Name field of an X.509 certificate, which allows man-in-     the-middle attackers to spoof arbitrary SSL servers via     a crafted certificate issued by a legitimate     Certification Authority, a related issue to     CVE-2009-2408. (CVE-2013-4238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that the embedded Expat copy in the interpreter for the Python language, does not properly process malformed or crafted XML files. (CVE-2009-3560 CVE-2009-3720 ) This vulnerability could allow an attacker to cause a denial of service while parsing a malformed XML file.

In addition, this update fixes an integer overflow in the hashlib module in python2.5. This vulnerability could allow an attacker to defeat cryptographic digests. (CVE-2008-2316 ) It only affects the oldstable distribution (etch).

This update of python fixes several security vulnerabilities.
(CVE-2008-1679 / CVE-2008-1887, CVE-2008-3143, CVE-2008-3142, CVE-2008-3144, CVE-2008-2315, CVE-2008-2316)

Note: for SLE10 a non-security bug in mmap was fixed too.

This update of python fixes several security vulnerabilities.
(CVE-2008-1679,CVE-2008-1887, CVE-2008-3143, CVE-2008-3142, CVE-2008-3144, CVE-2008-2315, CVE-2008-2316)

Multiple integer overflows in the imageop module in Python prior to 2.5.3 allowed context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows (CVE-2008-1679). This was due to an incomplete fix for CVE-2007-4965.

David Remahl of Apple Product Security reported several integer overflows in a number of core modules (CVE-2008-2315). He also reported an integer overflow in the hashlib module on Python 2.5 that lead to unreliable cryptographic digest results (CVE-2008-2316).

Justin Ferguson reported multiple buffer overflows in unicode string processing that affected 32bit systems (CVE-2008-3142).

Multiple integer overflows were reported by the Google Security Team that had been fixed in Python 2.5.2 (CVE-2008-3143).

Justin Ferguson reported a number of integer overflows and underflows in the PyOS_vsnprintf() function, as well as an off-by-one error when passing zero-length strings, that led to memory corruption (CVE-2008-3144).

The updated packages have been patched to correct these issues. As well, Python packages on Mandriva Linux 2007.1 and 2008.0 have been updated to version 2.5.2. Due to slight packaging changes on Mandriva Linux 2007.1, a new package is available (tkinter-apps) that contains binary files (such as /usr/bin/idle) that were previously in the tkinter package.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

Secunia reports :

Some vulnerabilities have been reported in Python, where some have unknown impact and others can potentially be exploited by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system.

Various integer overflow errors exist in core modules e.g.
stringobject, unicodeobject, bufferobject, longobject, tupleobject, stropmodule, gcmodule, mmapmodule.

An integer overflow in the hashlib module can lead to an unreliable cryptographic digest results.

Integer overflow errors in the processing of unicode strings can be exploited to cause buffer overflows on 32-bit systems.

An integer overflow exists in the PyOS_vsnprintf() function on architectures that do not have a 'vsnprintf()' function.

An integer underflow error in the PyOS_vsnprintf() function when passing zero-length strings can lead to memory corruption.

This update of python fixes several security vulnerabilities.
(CVE-2008-1679 / CVE-2008-1887 / CVE-2008-3143 / CVE-2008-3142 / CVE-2008-3144 / CVE-2008-2315 / CVE-2008-2316) Note: for SLE10 a non-security bug in mmap was fixed too.

New python packages are available for Slackware 10.1, 10.2, 11.0, 12.0, 12.1, and -current to fix security issues.

It was discovered that there were new integer overflows in the imageop module. If an attacker were able to trick a Python application into processing a specially crafted image, they could execute arbitrary code with user privileges. (CVE-2008-1679)

Justin Ferguson discovered that the zlib module did not correctly handle certain archives. If an attacker were able to trick a Python application into processing a specially crafted archive file, they could execute arbitrary code with user privileges. (CVE-2008-1721)

Justin Ferguson discovered that certain string manipulations in Python could be made to overflow. If an attacker were able to pass a specially crafted string through the PyString_FromStringAndSize function, they could execute arbitrary code with user privileges.
(CVE-2008-1887)

Multiple integer overflows were discovered in Python's core and modules including hashlib, binascii, pickle, md5, stringobject, unicodeobject, bufferobject, longobject, tupleobject, stropmodule, gcmodule, and mmapmodule. If an attacker were able to exploit these flaws they could execute arbitrary code with user privileges or cause Python applications to crash, leading to a denial of service.
(CVE-2008-2315, CVE-2008-2316, CVE-2008-3142, CVE-2008-3143, CVE-2008-3144).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200807-16 (Python: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Python:
    David Remahl of Apple Product Security reported several integer     overflows in core modules such as stringobject, unicodeobject,     bufferobject, longobject, tupleobject, stropmodule, gcmodule,     mmapmodule (CVE-2008-2315).
    David Remahl of Apple Product Security also reported an integer     overflow in the hashlib module, leading to unreliable cryptographic     digest results (CVE-2008-2316).
    Justin Ferguson reported multiple buffer overflows in unicode string     processing that only affect 32bit systems (CVE-2008-3142).
    The Google Security Team reported multiple integer overflows     (CVE-2008-3143).
    Justin Ferguson reported multiple integer underflows and overflows in     the PyOS_vsnprintf() function, and an off-by-one error when passing     zero-length strings, leading to memory corruption (CVE-2008-3144).
  Impact :

    A remote attacker could exploit these vulnerabilities in Python     applications or daemons that pass user-controlled input to vulnerable     functions. Exploitation might lead to the execution of arbitrary code     or a Denial of Service. Vulnerabilities within the hashlib might lead     to weakened cryptographic protection of data integrity or authenticity.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
133259	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	critical
127154	NewStart CGSL MAIN 5.04 : python Multiple Vulnerabilities (NS-SA-2019-0008)	Nessus	NewStart CGSL Local Security Checks	high
44841	Debian DSA-1977-1 : python2.4 python2.5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
41229	SuSE9 Security Update : Python (YOU Patch Number 12215)	Nessus	SuSE Local Security Checks	high
40115	openSUSE Security Update : python (python-128)	Nessus	SuSE Local Security Checks	high
37212	Mandriva Linux Security Advisory : python (MDVSA-2008:163)	Nessus	Mandriva Local Security Checks	critical
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	critical
34164	FreeBSD : python -- multiple vulnerabilities (0dccaa28-7f3c-11dd-8de5-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
33924	openSUSE 10 Security Update : python (python-5491)	Nessus	SuSE Local Security Checks	high
33923	SuSE 10 Security Update : Python (ZYPP Patch Number 5490)	Nessus	SuSE Local Security Checks	high
33824	Slackware 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / current : python (SSA:2008-217-01)	Nessus	Slackware Local Security Checks	high
33807	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : python2.4, python2.5 vulnerabilities (USN-632-1)	Nessus	Ubuntu Local Security Checks	critical
33782	GLSA-200807-16 : Python: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2008-2316

high

Tenable Plugins

critical

high

high

high

high

critical

critical

high

high

high

high

critical

high