CVE-2019-5010
Python.org Python 2.7.11/3.6.6 X509 parser allows DoS via crafted certificates
- CVSS 7.5
- CWE-476 NULL Pointer Dereference
- Memory Corruption
- Remote
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
- CVSS base score
- 7.5
- Published
- 2019-10-31
- OWASP
- A08 Software and Data Integrity Failures
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Memory Corruption
- Subcategory
- Out-of-Bound Accesses
- Accessibility scope
- Remote
- Impact
- Denial of Service (DoS)
- Fixed by upgrading
- Yes
Solution
Upgrade Python to version 2.8 or later.
Vulnerable code sample
import sqlite3
def authenticate_user(username, password):
# Vulnerable: Direct string concatenation in SQL query
# This allows SQL injection attacks
conn = sqlite3.connect('users.db')
cursor = conn.cursor()
query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'"
cursor.execute(query)
result = cursor.fetchone()
conn.close()
return result is not None
# Example of vulnerable usage:
# malicious_input = "admin'; DROP TABLE users; --"
# authenticate_user(malicious_input, "password") # SQL injection attack!Patched code sample
import sqlite3
import hashlib
import secrets
def authenticate_user(username, password):
# Secure: Use parameterized queries and proper password hashing
conn = sqlite3.connect('users.db')
cursor = conn.cursor()
try:
# Use parameterized query to prevent SQL injection
query = "SELECT password_hash, salt FROM users WHERE username = ?"
cursor.execute(query, (username,))
result = cursor.fetchone()
if result:
stored_hash, salt = result
# Hash the provided password with the stored salt
password_hash = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000)
return secrets.compare_digest(stored_hash, password_hash)
return False
finally:
conn.close()
# Example of secure usage:
# authenticate_user("admin", "password123") # Safe parameterized queryCite this entry
@misc{vaitp:cve20195010,
title = {{Python.org Python 2.7.11/3.6.6 X509 parser allows DoS via crafted certificates}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2019},
note = {VAITP Python Vulnerability Dataset, entry CVE-2019-5010},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-5010/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::