Missing Initialization of Resource

Affecting python2.7 package, versions <2.7.9-2+deb8u3

Overview

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

References

• CVE Details
• Debian Security Advisory
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Announcement
• Debian Security Tracker
• Fedora Security Update
• MISC
• MLIST
• REDHAT
• RHSA Security Advisory
• RHSA Security Advisory
• RedHat Bugzilla Bug
• SUSE
• Security Focus
• Security Tracker
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory