Python: PCRE Integer overflow

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200802-10 / python
Release Date	February 23, 2008
Latest Revision	February 23, 2008: 01
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
dev-lang/python	< 2.3.6-r4	>= 2.3.6-r4	All supported architectures

Related bugreports: #198373

Synopsis

A vulnerability within Python's copy of PCRE might lead to the execution of arbitrary code.

2. Impact Information

Background

Python is an interpreted, interactive, object-oriented programming language.

Description

Python 2.3 includes a copy of PCRE which is vulnerable to an integer overflow vulnerability, leading to a buffer overflow.

Impact

An attacker could exploit the vulnerability by tricking a vulnerable Python application to compile a regular expressions, which could possibly lead to the execution of arbitrary code, a Denial of Service or the disclosure of sensitive information.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Python 2.3 users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/python-2.3.6-r4"

4. References

Page updated February 23, 2008

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.