UbuntuUpdates.org

Package "libpython2.7-stdlib"

Name: libpython2.7-stdlib

Description:

Interactive high-level object-oriented language (standard library, version 2.7)
Latest version: 2.7.17-1~18.04ubuntu1.11
Release: bionic (18.04)
Level: security
Repository: main
Head package: python2.7

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libpython2.7-stdlib"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libpython2.7-stdlib" in Bionic

Repository Area Version
base main 2.7.15~rc1-1
updates main 2.7.17-1~18.04ubuntu1.11

Changelog

Version: 2.7.17-1~18.04ubuntu1.5 2021-02-25 20:07:06 UTC

  python2.7 (2.7.17-1~18.04ubuntu1.5) bionic-security; urgency=medium

  * SECURITY REGRESSION: previous update caused a regression that causes it
    pending further investigation this update reverts it
    - debian/patches/CVE-2021-3177.patch: was removed.

 -- Leonidas Da Silva Barbosa <email address hidden> Thu, 25 Feb 2021 11:02:55 -0300
Source diff to previous version
CVE-2021-3177 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applic

Version: 2.7.17-1~18.04ubuntu1.3 2021-02-25 14:06:19 UTC

  python2.7 (2.7.17-1~18.04ubuntu1.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2021-3177.patch: replace snprintf with Python unicode
      formatting in ctypes param reprs in Lib/ctypes/test/test_parameters.py,
      Modules/_ctypes/callproc.c.
    - CVE-2021-3177

 -- Leonidas Da Silva Barbosa <email address hidden> Fri, 29 Jan 2021 12:18:18 -0300
Source diff to previous version
CVE-2021-3177 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applic

Version: 2.7.17-1~18.04ubuntu1.2 2020-10-14 17:07:00 UTC

  python2.7 (2.7.17-1~18.04ubuntu1.2) bionic-security; urgency=medium

  * SECURITY UPDATE: CRLF injection
    - debian/patches/CVE-2020-26116.patch: prevent header injection
      in http methods in Lib/httplib.py, Lib/test/test_httlib.py.
    - CVE-2020-26116
  * debian/patches/issue9146.patch: re-adding fix FIPS mode environments where MD5
    isn't available in Modules/_hashopenssl.c. (LP: #1898078)

 -- <email address hidden> (Leonidas S. Barbosa) Wed, 30 Sep 2020 10:38:04 -0300
Source diff to previous version
1898078 FIPS OpenSSL crashes Python2.7 hashlib when using MD5
CVE-2020-26116 http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker contro

Version: 2.7.17-1~18.04ubuntu1.1 2020-07-22 15:06:21 UTC

  python2.7 (2.7.17-1~18.04ubuntu1.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Misleading information
    - debian/patches/CVE-2019-17514.patch: explain that the orderness of the
      of the result is system-dependant in Doc/library/glob.rst.
    - CVE-2019-17514
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-9674.patch: add pitfalls to
      zipfile module doc in Doc/library/zipfile.rst,
      Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst.
    - CVE-2019-9674
  * SECURITY UPDATE: Infinite loop
    - debian/patches/CVE-2019-20907.patch: avoid infinite loop in the
      tarfile module in Lib/tarfile.py, Lib/test/test_tarfile.py.
    - CVE-2019-20907

 -- <email address hidden> (Leonidas S. Barbosa) Mon, 20 Jul 2020 12:37:01 -0300
Source diff to previous version
CVE-2019-17514 library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrate
CVE-2019-9674 Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
CVE-2019-20907 In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, becaus

Version: 2.7.17-1~18.04ubuntu1 2020-04-21 14:06:21 UTC

  python2.7 (2.7.17-1~18.04ubuntu1) bionic-security; urgency=medium

  * SECURITY UPDATE: CRLF injection
    - debian/patches/CVE-2019-18348.patch: disallow control characters
      in hostnames in http.client in Lib/httplib.py, Lib/test/test_urllib2.py.
    - CVE-2019-18348
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2020-8492.patch: fix the regex to prevent
      the regex denial of service in Lib/urllib2.py.
    - CVE-2020-8492

 -- <email address hidden> (Leonidas S. Barbosa) Wed, 15 Apr 2020 14:20:14 -0300
CVE-2019-18348 An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker co
CVE-2020-8492 Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular E


About   -   Send Feedback to @ubuntu_updates