PT-2008-4563 · Python+2 · Python+2

Published 2008-08-01 · Updated 2024-06-15 · CVE-2008-3144

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Python versions prior to 2.5.2

Description: The issue is related to multiple integer overflows in the PyOS vsnprintf function, which can be exploited by context-dependent attackers using crafted input to string formatting operations. This can lead to a denial of service due to memory corruption or have other unspecified impacts. The handling of certain integer values is also affected by related integer underflows and an off-by-one error.

Recommendations: For versions prior to 2.5.2, update to a version that includes the fix for the integer overflows in the PyOS vsnprintf function. As a temporary workaround, consider restricting the use of string formatting operations with crafted input until a patch is available.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2008-3144

DSA-1667-1

DTSA-157-1

OPENSUSE-SU-2024:11202-1

PSF-2008-8

RHSA-2009:1176

RHSA-2009:1177

RHSA-2009:1178

RHSA-2009_1176

RHSA-2009_1177

SUSE-SU-2020:0234-1

Affected Products

Python

Red Hat

Suse

References · 198

• 🔥 http://bugs.python.org/issue2588 · Exploit
• http://bugs.python.org/issue2589 · Vendor Advisory
• http://ubuntu.com/usn/usn-632-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3144 · Security Note
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.525289 · Vendor Advisory
• https://osv.dev/vulnerability/PSF-2008-8 · Vendor Advisory
• http://svn.python.org/view?rev=63734&view=rev · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200807-16.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:164 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:163 · Vendor Advisory
• http://svn.python.org/view?rev=63728&view=rev · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11202-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html · Vendor Advisory
• http://debian.org/security/2008/dsa-1667 · Vendor Advisory