PT-2015-3542 · Python+5 · Python+5

Christian Heimes + 1 · Published 2014-03-24 · Updated 2024-06-15 · CVE-2013-1753

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Python versions 3.4 and earlier

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, via a crafted HTTP request. This is due to a problem in the gzip decode function within the xmlrpc client library.

Recommendations For versions 3.4 and earlier, consider disabling the gzip decode function as a temporary workaround until a patch is available. Restrict access to the xmlrpc client library to minimize the risk of exploitation. Avoid using the xmlrpc client library with untrusted HTTP requests until the issue is resolved.

Exploit

Fix

Related Identifiers

ALT-PU-2015-1995

ALT-PU-2016-1294

CESA-2015_2101

CVE-2013-1753

MGASA-2014-0139

OPENSUSE-SU-2024:10536-1

OPENSUSE-SU-2024:11202-1

PSF-2020-1

RHSA-2015:1064

RHSA-2015:2101

RHSA-2015_2101

SUSE-SU-2015:1344-1

SUSE-SU-2020:0234-1

USN-2653-1

Affected Products

Alt Linux

Centos

Python

Red Hat

Suse

Ubuntu

References · 206

• 🔥 https://github.com/bunseokbot/CVE-2016-5699-poc · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7040 · Security Note
• https://osv.dev/vulnerability/CVE-2013-1753 · Vendor Advisory
• https://bugs.python.org/issue16043 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1752 · Security Note
• https://ubuntu.com/security/CVE-2013-1752 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2653-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-4650 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1753 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10536-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2667 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:0234-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2653-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1753 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-1753 · Vendor Advisory