High · published November 1, 2019
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
| Product | Versions | Fixed in |
|---|---|---|
| python/python | ≥ 2.7.0, < 2.7.16 | 2.7.16 |
| python/python | ≥ 3.4.0, < 3.4.10 | 3.4.10 |
| python/python | ≥ 3.5.0, < 3.5.7 | 3.5.7 |
| python/python | ≥ 3.6.0, < 3.6.9 | 3.6.9 |
| python/python | ≥ 3.7.0, < 3.7.3 | 3.7.3 |
| opensuse/leap | all versions | — |
| debian/debian_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |