Is CVE-2019-5010 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 21%.

What products does CVE-2019-5010 affect?

Tracked products affected include Python. Check the version you run to see whether it is affected.

How do I fix CVE-2019-5010?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2019-5010

Q: What is CVE-2019-5010?

CVE-2019-5010 is a high-severity software vulnerability (CWE-476) with a CVSS score of 7.5. An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attack

HIGH severity · CVSS 7.5 · CWE-476

7.5CVSS HIGH

Summary

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)21%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products we track (1)

Python

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlAdvisory
https://access.redhat.com/errata/RHSA-2019:3520Advisory
https://access.redhat.com/errata/RHSA-2019:3725Advisory
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/07/msg00011.htmlAdvisory
https://lists.debian.org/debian-lts-announce/2020/08/msg00034.htmlAdvisory
https://security.gentoo.org/glsa/202003-26Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758Advisory