Ubuntu alert USN-6400-1 (python2.7, python3.5)
| From: | Ian Constantin <ian.constantin@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-6400-1] Python vulnerability | |
| Date: | Wed, 27 Sep 2023 22:47:09 +0300 | |
| Message-ID: | <18eae4bf-19ff-ad28-987a-153c621cf752@canonical.com> |
========================================================================== Ubuntu Security Notice USN-6400-1 September 27, 2023 python2.7, python3.5 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) Summary: Python could be made to expose sensitive information. Software Description: - python2.7: An interactive high-level object-oriented language - python3.5: An interactive high-level object-oriented language Details: It was discovered that Python did not properly provide constant-time processing for a crypto operation. An attacker could possibly use this issue to perform a timing attack and recover sensitive information. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS (Available with Ubuntu Pro): libpython2.7 2.7.17-1~18.04ubuntu1.13+esm2 libpython2.7-minimal 2.7.17-1~18.04ubuntu1.13+esm2 libpython2.7-stdlib 2.7.17-1~18.04ubuntu1.13+esm2 Ubuntu 16.04 LTS (Available with Ubuntu Pro): libpython2.7 2.7.12-1ubuntu0~16.04.18+esm7 libpython2.7-minimal 2.7.12-1ubuntu0~16.04.18+esm7 libpython2.7-stdlib 2.7.12-1ubuntu0~16.04.18+esm7 libpython3.5 3.5.2-2ubuntu0~16.04.13+esm11 libpython3.5-minimal 3.5.2-2ubuntu0~16.04.13+esm11 libpython3.5-stdlib 3.5.2-2ubuntu0~16.04.13+esm11 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6400-1 CVE-2022-48566