| Description: | Summary:
The remote host is missing an update for the Debian 'python2.7' package(s) announced via the DLA-2919-1 advisory.
Vulnerability Insight:
Two issues have been discovered in python2.7:
CVE-2021-3177
Python has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input.
CVE-2021-4189
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library when using it in PASV (passive) mode. The flaw lies in how the FTP client trusts the host from PASV response by default. An attacker could use this flaw to setup a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This could lead to FTP client scanning ports which otherwise would not have been possible. . Instead of using the returned address, ftplib now uses the IP address we're already connected to. For the rare user who wants an old behavior, set a `trust_server_pasv_ipv4_address` attribute on your `ftplib.FTP` instance to True.
For Debian 9 stretch, these problems have been fixed in version 2.7.13-2+deb9u6.
We recommend that you upgrade your python2.7 packages.
For the detailed security status of python2.7 please refer to its security tracker page at: [link moved to references]
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references]
Affected Software/OS:
'python2.7' package(s) on Debian 9.
Solution:
Please install the updated package(s).
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
