正文

Python 资源管理错误漏洞

admin
admin V管理员 /0 评论 /9 阅读
0304
此篇文章发布距今已超过1215天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

Python 资源管理错误漏洞

  • CNNVD编号：CNNVD-202006-1232
    • <!--
  • 危害等级： 中危-->
  • 危害等级： 中危
  • CVE编号： CVE-2020-14422
  • 漏洞类型： 资源管理错误
  • 发布时间： 2020-06-18
  • 威胁类型： 远程
  • 更新时间： 2021-12-01
  • 厂        商：
  • 漏洞来源： Red Hat

漏洞简介

Python是Python基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。

Python 3.8.3及之前版本中的Lib/ipaddress.py文件的IPv4Interface和IPv6Interface存在资源管理错误漏洞，该漏洞源于程序未正确计算哈希值。远程攻击者可利用该漏洞造成拒绝服务或创建许多字典条目。

漏洞公告

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://bugs.python.org/issue41004

参考网址

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/

来源:MISC

链接:https://github.com/python/cpython/pull/20956

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/

来源:MISC

链接:https://www.oracle.com/security-alerts/cpujan2021.html

来源:GENTOO

链接:https://security.gentoo.org/glsa/202008-01

来源:MISC

链接:https://bugs.python.org/issue41004

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/

来源:CONFIRM

链接:https://security.netapp.com/advisory/ntap-20200724-0004/

来源:UBUNTU

链接:https://usn.ubuntu.com/4428-1/

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/

来源:MLIST

链接:https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/

来源:FEDORA

链接:https://lists.fedoraproject.org/archives/list/[email protected]/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.3614/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/160125/Red-Hat-Security-Advisory-2020-5149-01.html

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/160207/Red-Hat-Security-Advisory-2020-5118-01.html

来源:www.cybersecurity-help.cz

链接:https://www.cybersecurity-help.cz/vdb/SB2021052216

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/159655/Red-Hat-Security-Advisory-2020-4299-01.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.4179/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.2421/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.2465/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.1727

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.1207

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.2796/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/159811/Red-Hat-Security-Advisory-2020-4433-01.html

来源:vigilance.fr

链接:https://vigilance.fr/vulnerability/Python-denial-of-service-via-Lib-ipaddress-py-Hash-Collision-32588

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-watson-openscale-on-cloud-pak-for-data-is-impacted-by-cve-2020-14422/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/159997/Red-Hat-Security-Advisory-2020-5010-01.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.3591/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.4513/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0234/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/158705/Gentoo-Linux-Security-Advisory-202008-01.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0584

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.3212/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/158524/Ubuntu-Security-Notice-USN-4428-1.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.3870/

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-private-is-vulnerable-to-a-python-vulnerability-cve-2020-14422/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.3995/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.3887/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.4237/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0864

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/159626/Red-Hat-Security-Advisory-2020-4285-01.html

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-in-python3-affect-ibm-cloud-pak-for-multicloud-management-hybrid-grc/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.4100/

来源:www.ibm.com

链接:https://www.ibm.com/support/pages/node/6520474

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0691

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.2511/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/162694/Red-Hat-Security-Advisory-2021-2021-01.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0013/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0099/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2020.2729/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/162142/Red-Hat-Security-Advisory-2021-1079-01.html

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-14422

受影响实体

    暂无


补丁

  • Python 资源管理错误漏洞的修复措施
    <!--
    2020-6-18
    -->