MGASA-2018-0495
- Source
- https://advisories.mageia.org/MGASA-2018-0495.html
- Import Source
- https://advisories.mageia.org/MGASA-2018-0495.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2018-0495
- Related
- Published
- 2018-12-31T22:42:09Z
- Modified
- 2018-12-31T22:14:45Z
- Summary
- Updated python packages fix security vulnerabilities
- Details
-
Possible denial of service vulnerability due to a missing check in Lib/wave.py to verify that at least one channel is provided (CVE-2017-18207).
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM (CVE-2018-14647).
It was discovered that the shutil module of python does not properly sanitize input when creating a zip file on Windows. An attacker could use this flaw to cause a denial of service or add unintended files to the generated archive (CVE-2018-1000802).
- References
-
- https://advisories.mageia.org/MGASA-2018-0495.html
- https://bugs.mageia.org/show_bug.cgi?id=23061
- https://lists.opensuse.org/opensuse-updates/2018-04/msg00041.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/O4ERR26C7JCSELMELHCVZ5TZXFKHBJ72/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HFL5UURGWQ53IKGPTD7B4MKMSMUZPTGU/
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:6 / python
Package
- Name
- python
- Purl
- pkg:rpm/mageia/python?distro=mageia-6