USN-7015-6
python2.7 regresssions
USN-7015-5 fixed vulnerabilities in python2.7. The update introduced several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email addresses that contain special characters. A remote attacker could possibly use this issue to bypass certain protection mechanisms. (CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing certain tarfile headers. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines for email headers. A remote attacker could possibly use this issue to perform header injection. (CVE-2024-6923)
It was discovered that the Python http.cookies module incorrectly handled parsing cookies that contained backslashes for quoted characters. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-2024-7592)
It was discovered that the Python zipfile module incorrectly handled certain malformed zip files. A remote attacker could possibly use this issue to cause Python to stop responding, resulting in a denial of service. (CVE-2024-8088)
What each source reports
OSV No score
python2.7 regresssions
USN-7015-5 fixed vulnerabilities in python2.7. The update introduced several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email addresses that contain special characters. A remote attacker could possibly use this issue to bypass certain protection mechanisms. (CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing certain tarfile headers. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines for email headers. A remote attacker could possibly use this issue to perform header injection. (CVE-2024-6923)
It was discovered that the Python http.cookies module incorrectly handled parsing cookies that contained backslashes for quoted characters. A remote attacker could possibly use this issue to cause Python to consume resources, leading to a denial of service. (CVE-2024-7592)
It was discovered that the Python zipfile module incorrectly handled certain malformed zip files. A remote attacker could possibly use this issue to cause Python to stop responding, resulting in a denial of service. (CVE-2024-8088)
- Record
USN-7015-6- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python2.7Ubuntu:Pro:14.04:LTS |
before 2.7.6-8ubuntu0.6+esm22, plus listed versions 2.7.5-8ubuntu32.7.5-8ubuntu42.7.6-22.7.6-2ubuntu12.7.6-3 Show 28 moreShow less2.7.6-3ubuntu12.7.6-42.7.6-4ubuntu12.7.6-52.7.6-72.7.6-82.7.6-8ubuntu0.22.7.6-8ubuntu0.32.7.6-8ubuntu0.42.7.6-8ubuntu0.52.7.6-8ubuntu0.6+esm22.7.6-8ubuntu0.6+esm32.7.6-8ubuntu0.6+esm52.7.6-8ubuntu0.6+esm62.7.6-8ubuntu0.6+esm72.7.6-8ubuntu0.6+esm82.7.6-8ubuntu0.6+esm92.7.6-8ubuntu0.6+esm102.7.6-8ubuntu0.6+esm112.7.6-8ubuntu0.6+esm122.7.6-8ubuntu0.6+esm132.7.6-8ubuntu0.6+esm142.7.6-8ubuntu0.6+esm152.7.6-8ubuntu0.6+esm162.7.6-8ubuntu0.6+esm172.7.6-8ubuntu0.6+esm182.7.6-8ubuntu0.6+esm202.7.6-8ubuntu0.6+esm21 |
2.7.6-8ubuntu0.6+esm22 |
python2.7Ubuntu:Pro:16.04:LTS |
before 2.7.12-1ubuntu0~16.04.18+esm13, plus listed versions 2.7.10-4ubuntu12.7.10-4ubuntu22.7.11-22.7.11-32.7.11-4 Show 28 moreShow less2.7.11-62.7.11-72.7.11-7ubuntu12.7.12-1~16.042.7.12-1ubuntu0~16.04.12.7.12-1ubuntu0~16.04.22.7.12-1ubuntu0~16.04.32.7.12-1ubuntu0~16.04.42.7.12-1ubuntu0~16.04.82.7.12-1ubuntu0~16.04.92.7.12-1ubuntu0~16.04.112.7.12-1ubuntu0~16.04.122.7.12-1ubuntu0~16.04.132.7.12-1ubuntu0~16.04.142.7.12-1ubuntu0~16.04.162.7.12-1ubuntu0~16.04.182.7.12-1ubuntu0~16.04.18+esm12.7.12-1ubuntu0~16.04.18+esm22.7.12-1ubuntu0~16.04.18+esm32.7.12-1ubuntu0~16.04.18+esm42.7.12-1ubuntu0~16.04.18+esm52.7.12-1ubuntu0~16.04.18+esm62.7.12-1ubuntu0~16.04.18+esm72.7.12-1ubuntu0~16.04.18+esm82.7.12-1ubuntu0~16.04.18+esm92.7.12-1ubuntu0~16.04.18+esm102.7.12-1ubuntu0~16.04.18+esm112.7.12-1ubuntu0~16.04.18+esm12 |
2.7.12-1ubuntu0~16.04.18+esm13 |
python2.7Ubuntu:Pro:18.04:LTS |
before 2.7.17-1~18.04ubuntu1.13+esm8, plus listed versions 2.7.14-2ubuntu22.7.14-42.7.14-62.7.14-72.7.14-8 Show 24 moreShow less2.7.15~rc1-12.7.15~rc1-1ubuntu0.12.7.15-4ubuntu4~18.042.7.15-4ubuntu4~18.04.12.7.15-4ubuntu4~18.04.22.7.17-1~18.042.7.17-1~18.04ubuntu12.7.17-1~18.04ubuntu1.12.7.17-1~18.04ubuntu1.22.7.17-1~18.04ubuntu1.32.7.17-1~18.04ubuntu1.52.7.17-1~18.04ubuntu1.62.7.17-1~18.04ubuntu1.72.7.17-1~18.04ubuntu1.82.7.17-1~18.04ubuntu1.102.7.17-1~18.04ubuntu1.112.7.17-1~18.04ubuntu1.132.7.17-1~18.04ubuntu1.13+esm12.7.17-1~18.04ubuntu1.13+esm22.7.17-1~18.04ubuntu1.13+esm32.7.17-1~18.04ubuntu1.13+esm42.7.17-1~18.04ubuntu1.13+esm52.7.17-1~18.04ubuntu1.13+esm62.7.17-1~18.04ubuntu1.13+esm7 |
2.7.17-1~18.04ubuntu1.13+esm8 |
python2.7Ubuntu:20.04:LTS |
before 2.7.18-1~20.04.6, plus listed versions 2.7.17~rc1-12.7.17-12.7.17-1ubuntu52.7.17-1ubuntu62.7.18~rc1-2 Show 5 moreShow less2.7.18-1~20.042.7.18-1~20.04.12.7.18-1~20.04.32.7.18-1~20.04.42.7.18-1~20.04.5 |
2.7.18-1~20.04.6 |
python2.7Ubuntu:22.04:LTS |
before 2.7.18-13ubuntu1.4, plus listed versions 2.7.18-8build12.7.18-132.7.18-13ubuntu12.7.18-13ubuntu1.12.7.18-13ubuntu1.22.7.18-13ubuntu1.3 |
2.7.18-13ubuntu1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-7015-6 is a vulnerability with no CVSS score yet in python2.7, published November 22, 2024. No source lists public exploit code. Fixed in python2.7 2.7.6-8ubuntu0.6+esm22.