Skip to content
VulniPulse
Sign in
Advisory severityHigh7.5Vendor: MediumRed Hat Linux

High [CVE-2019-5010] exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6

This high-severity Red Hat Linux advisory covers CVE-2019-5010 affecting Red Hat Ansible Tower 3.4 for RHEL 7, Red Hat Enterprise Linux 8, Red Hat Software Collections for Red Hat Enterprise Linux 6.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2019-5010 Source published Source updated

VulniPulse record published

CVE-2019-5010
Affected products & platforms
Red Hat LinuxRed Hat Enterprise Linux
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service.

An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability. A null pointer dereference vulnerability was found in the certificate parsing code in Python.

This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities.

This issue did not affect the versions of python as shipped with Red Hat Enterprise Linux 5 and 6. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-476.

Affected Red Hat products: Red Hat Ansible Tower 3.4 for RHEL 7; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Software Collections for Red Hat Enterprise Linux 6; Red Hat Software Collections for Red Hat Enterprise Linux 7; Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS; Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS; Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS; Red Hat Software Collections.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Fixed versions
  • ansible-tower-34/ansible-tower-memcached:1.4.15-28
  • ansible-tower-35/ansible-tower-memcached:1.4.15-28
  • ansible-tower-37/ansible-tower-memcached-rhel7:1.4.15-28
  • python-0:2.7.5-86.el7
  • python3-0:3.6.8-15.1.el8
  • rh-python36-python-0:3.6.9-2.el6
  • rh-python36-python-0:3.6.9-2.el7
  • RHBA-2020:0547
  • RHSA-2019:2030
  • RHSA-2019:3520
  • RHSA-2019:3725

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Mitigation

Upgrade to a fixed release: ansible-tower-34/ansible-tower-memcached:1.4.15-28, ansible-tower-35/ansible-tower-memcached:1.4.15-28, ansible-tower-37/ansible-tower-memcached-rhel7:1.4.15-28, python-0:2.7.5-86.el7, python3-0:3.6.8-15.1.el8, rh-python36-python-0:3.6.9-2.el6. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.