python2.7: CVE-2019-5010: NULL pointer dereference using a specially crafted X509 certificate

Debian Bug report logs - #921040
python2.7: CVE-2019-5010: NULL pointer dereference using a specially crafted X509 certificate

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2019-5010

Date: Fri, 01 Feb 2019 00:33:35 +0100

Package: python2.7
Version: 2.7.15-5
Severity: important
Tags: security

This was assigned CVE-2019-5010:
https://bugs.python.org/issue35746
https://github.com/python/cpython/pull/11569

Patch for 2.7:
https://github.com/python/cpython/commit/06b15424b0dcacb1c551b2a36e739fffa8d0c595

Cheers,
        Moritz
     

Message #14 received at 921040@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Moritz Muehlenhoff <jmm@debian.org>, 921040@bugs.debian.org

Subject: Re: Bug#921040: CVE-2019-5010

Date: Fri, 1 Feb 2019 08:26:11 +0100

Control: retitle -1 python2.7: CVE-2019-5010: NULL pointer dereference using a specially crafted X509 certificate
Control clone -1 -2 -3
Control: reassign -2 src:python3.6 3.6.8-1
Control: retitle -2 python3.6: CVE-2019-5010: NULL pointer dereference using a specially crafted X509 certificate
Control: reassign -3 src:python3.7 3.7.2-1
Control: retitle -3 python3.7: CVE-2019-5010: NULL pointer dereference using a specially crafted certificate

On Fri, Feb 01, 2019 at 12:33:35AM +0100, Moritz Muehlenhoff wrote:
> Package: python2.7
> Version: 2.7.15-5
> Severity: important
> Tags: security
> 
> This was assigned CVE-2019-5010:
> https://bugs.python.org/issue35746
> https://github.com/python/cpython/pull/11569
> 
> Patch for 2.7:
> https://github.com/python/cpython/commit/06b15424b0dcacb1c551b2a36e739fffa8d0c595

Affects as well the versions in unstable for python3.6 and python3.7
so cloning the bug accordingly.

Regards,
Salvatore

Message #23 received at 921040-close@bugs.debian.org (full text, mbox, reply):

From: Matthias Klose <doko@debian.org>

To: 921040-close@bugs.debian.org

Subject: Bug#921040: fixed in python2.7 2.7.15-6

Date: Fri, 01 Feb 2019 08:48:22 +0000

Source: python2.7
Source-Version: 2.7.15-6

We believe that the bug you reported is fixed in the latest version of
python2.7, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 921040@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Matthias Klose <doko@debian.org> (supplier of updated python2.7 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 01 Feb 2019 08:18:31 +0100
Source: python2.7
Architecture: source
Version: 2.7.15-6
Distribution: unstable
Urgency: medium
Maintainer: Matthias Klose <doko@debian.org>
Changed-By: Matthias Klose <doko@debian.org>
Closes: 921039 921040
Changes:
 python2.7 (2.7.15-6) unstable; urgency=medium
 .
   * Update to 20190201 from the 2.7 branch.
     - CVE-2013-1752: Limit imaplib.IMAP4_SSL.readline().
     - CVE-2018-14647: _elementtree.c doesn't call XML_SetHashSalt().
       Closes: #921039.
     - CVE-2019-5010: DsO vulnerability exists in the X509 certificate parser.
       Closes: #921040.
   * Bump standards version.
   * Update symbols file.
Checksums-Sha1:
 330274af10115129a5130f3914f45ffad439b94a 3344 python2.7_2.7.15-6.dsc
 26c02e807e241461f71ed515814741d788cb0160 596337 python2.7_2.7.15-6.diff.gz
 d38f6d0200a447c3890e4f27f319c15418f0c015 10050 python2.7_2.7.15-6_source.buildinfo
Checksums-Sha256:
 0179e286a457fffde54a6731f306fd86f386b8db33aa88ff9c9760115f9125c4 3344 python2.7_2.7.15-6.dsc
 b3c63e731e47ef48fa0087ed922679d55772fedc2bcb7ac414ca677a0feb2266 596337 python2.7_2.7.15-6.diff.gz
 30b62b5ac02566c600ea4045fc446165a33191bafe9bf3384066be165bc43610 10050 python2.7_2.7.15-6_source.buildinfo
Files:
 f5e28cb0db5d2c168e3758d1f9c67518 3344 python optional python2.7_2.7.15-6.dsc
 54619766bcdafd0cb9d4d5f7b237d4c1 596337 python optional python2.7_2.7.15-6.diff.gz
 7d1180beb276bb990e9653d51b9328ce 10050 python optional python2.7_2.7.15-6_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJEBAEBCAAuFiEE1WVxuIqLuvFAv2PWvX6qYHePpvUFAlxT/agQHGRva29AZGVi
aWFuLm9yZwAKCRC9fqpgd4+m9fTjD/9Ma/8erwYWu8yiJb9I2Tp6UCv9ycs8+8f4
CffK+DC2Iv9L9C6rS0/UQ7qsxIoUUahCqC5786LNUcP+D3sneyWKxsQ41qnHQDyD
YmRt969UpcG/l94Ten3enPXEoIc0ktNOyClmN0AjlkWqy6i1IpJhHaDLzAQamIfo
jrpBa+grGmUAeMBQfZVmmxrhpVfT/Fqr1AEgx49ifnGTJGefCa2IGWdmfrhoipcG
k82tFmnL/lhU4+SZEfAcmgtcEnF9dmX/aGQ0PH6GVQQObfEQ4SOWEF/qE1YGigy4
B5jgIetbBDXdIHiUVKoeJ/uqko0fNtg16Je6u7w54zjIlsrYStCWAWydR7Bw549K
AkQXRqkgHeSoh/fYWjLBTiGMUDBMRaUCnLe+y2Sq4RdX+6OHxxZFLdNZG6tEpEQd
4sv8KXavY9NAcIyUV4G4H1G1NIQ3S1n9FS5ItNRbGidVvR6E1usi/mD6f3hLwnyl
MTrmh9vVlKraqiFCKr2u4y7i9rRujk/HByMFzGoJaRTTDJ8ThewQynGxvn91maOj
GJyfCj2HAkYFd5d1Jk/3gQrLSd/vmcr/iJFvOO93H4W9pkUt7WgffuWHgSsiC+eK
Sc69SQ+owbDbf0Bcan5DNPJ3MspbP53nXJRllY452qIGd/LoNqSg4qsoSVeByVDn
lGZOy4btNg==
=MBp/
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.