Headline
Ubuntu Security Notice USN-6400-1
Ubuntu Security Notice 6400-1 - It was discovered that Python did not properly provide constant-time processing for a crypto operation. An attacker could possibly use this issue to perform a timing attack and recover sensitive information.
==========================================================================
Ubuntu Security Notice USN-6400-1
September 27, 2023
python2.7, python3.5 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Python could be made to expose sensitive information.
Software Description:
- python2.7: An interactive high-level object-oriented language
- python3.5: An interactive high-level object-oriented language
Details:
It was discovered that Python did not properly provide constant-time
processing for a crypto operation. An attacker could possibly use this
issue to perform a timing attack and recover sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libpython2.7 2.7.17-1~18.04ubuntu1.13+esm2
libpython2.7-minimal 2.7.17-1~18.04ubuntu1.13+esm2
libpython2.7-stdlib 2.7.17-1~18.04ubuntu1.13+esm2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libpython2.7 2.7.12-1ubuntu0~16.04.18+esm7
libpython2.7-minimal 2.7.12-1ubuntu0~16.04.18+esm7
libpython2.7-stdlib 2.7.12-1ubuntu0~16.04.18+esm7
libpython3.5 3.5.2-2ubuntu0~16.04.13+esm11
libpython3.5-minimal 3.5.2-2ubuntu0~16.04.13+esm11
libpython3.5-stdlib 3.5.2-2ubuntu0~16.04.13+esm11
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6400-1
CVE-2022-48566
Related news
Ubuntu Security Notice 6891-1 - It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS. It was discovered that Python incorrectly used regular expressions vulnerable to catastrophic backtracking. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS.
Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to read arbitrary files from the target system.
An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.