Skip to content
Fencer Intel
medium 5.9

CVE-2019-5010 json

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.

published 7y ago modified last mo. also EUVD-2019-14617

cvss
5.9
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
20.7%
EPSS 20.7% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

Patch / fix

  • python python 2.7.16, 3.4.10, 3.5.7, 3.6.9, 3.7.3
  • python2.7 Debian 11 2.7.15-6

debian advisories DEBIAN-CVE-2019-5010

  • python2.7 Ubuntu 16.04 LTS 2.7.12-1ubuntu0~16.04.8
  • python2.7 Ubuntu 18.04 LTS 2.7.15-4ubuntu4~18.04.1
  • python3.5 Ubuntu 16.04 LTS 3.5.2-2ubuntu0~16.04.8
  • python3.6 Ubuntu 18.04 LTS 3.6.8-1~18.04.2
  • python3.4 Ubuntu Pro 14.04 LTS 3.4.3-1ubuntu1~14.04.7+esm2
  • python3.5 Ubuntu Pro 14.04 LTS 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1

ubuntu advisories UBUNTU-CVE-2019-5010

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rh-python36-python RHEL 3 SOFTWARE_COLLECTIONS 3.6.9-2.el6
  • rh-python36-python RHEL 3 SOFTWARE_COLLECTIONS 3.6.9-2.el7
  • rh-python36-python-libs RHEL 3 SOFTWARE_COLLECTIONS 3.6.9-2.el6
  • rh-python36-python-libs RHEL 3 SOFTWARE_COLLECTIONS 3.6.9-2.el7
  • rh-python36-python-test RHEL 3 SOFTWARE_COLLECTIONS 3.6.9-2.el6
  • rh-python36-python-test RHEL 3 SOFTWARE_COLLECTIONS 3.6.9-2.el7
  • rh-python36-python-tools RHEL 3 SOFTWARE_COLLECTIONS 3.6.9-2.el6
  • rh-python36-python-tools RHEL 3 SOFTWARE_COLLECTIONS 3.6.9-2.el7

red hat advisories RHSA-2019:3725RHSA-2019:3520RHSA-2019:2030

  • python3 SLES for SAP 15, SLES 15-LTSS, SLE Module for Basesystem 15 SP2 +3 more 3.6.12-3.67.2
  • python3-core SLES for SAP 15, SLES 15-LTSS, SLE Module for Development Tools 15 SP2 +5 more 3.6.12-3.67.2
  • python36 SLES for SAP 12 SP5, SLES 12 SP5 3.6.12-4.22.2
  • python36-core SLES for SAP 12 SP5, SLES 12 SP5 3.6.12-4.22.2
  • python36 SLES for SAP 12 SP5, SLES 12 SP5 3.6.10-4.3.5
  • python36-base SLES for SAP 12 SP5, SLES 12 SP5 3.6.10-4.3.5
  • python SLE Module for Python 2 15 SP1, SLE Module for Desktop Applications 15 SP1, SLE Module for Desktop Applications 15 +2 more 2.7.17-7.32.2
  • python-base SLE Module for Python 2 15 SP1, SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 2.7.17-7.32.1

suse advisories SUSE-SU-2020:3930-1SUSE-SU-2020:3563-1SUSE-SU-2020:0302-1SUSE-SU-2020:0234-1SUSE-SU-2019:14246-1SUSE-SU-2020:0114-1

  • python315 openSUSE Tumbleweed 3.15.0~a1-1.1
  • python314 openSUSE Tumbleweed 3.14.0~a1-1.1
  • python313 openSUSE Tumbleweed 3.13.0~b3-1.1
  • python openSUSE Tumbleweed 2.7.18-8.1
  • python310 openSUSE Tumbleweed 3.10.0rc1-4.2
  • python36 openSUSE Tumbleweed 3.6.15-1.1
  • python38 openSUSE Tumbleweed 3.8.12-1.2
  • python39 openSUSE Tumbleweed 3.9.7-2.1

opensuse advisories openSUSE-SU-2025:15713-1openSUSE-SU-2024:14434-1openSUSE-SU-2024:14109-1openSUSE-SU-2024:11202-1openSUSE-SU-2024:11283-1openSUSE-SU-2024:11284-1

  • python2 Alpine 3.15, Alpine 3.14, Alpine 3.13 +4 more 2.7.15-r3
  • python3 Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 3.6.8-r1
  • python2-tkinter Alpine 3.11, Alpine 3.10, Alpine 3.9 2.7.15-r3
  • python3-tkinter Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 3.6.8-r1

alpine advisories ALPINE-CVE-2019-5010

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2019-5010 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-5010 updated cvss 7.5

python: NULL pointer dereference using a specially crafted X509 certificate

  • Red Hat Software Collections rh-python35-python, rh-python35-python-libs, rh-python35-python-test, rh-python35-python-tools, rh-python35-python-tkinter
    affected: no fix planned “Will not fix”
  • Red Hat Ansible Tower 3.4 for RHEL 7 Server ansible-tower-34/ansible-tower-memcached 1.4.15-28, ansible-tower-35/ansible-tower-memcached 1.4.15-28, ansible-tower-37/ansible-tower-memcached-rhel7 1.4.15-28
    fixed: vendor fix RHBA-2020:0547
  • Red Hat Enterprise Linux AppStream (v. 8) python3-idle 3.6.8-15.1.el8, python3-test 3.6.8-15.1.el8, platform-python 3.6.8-15.1.el8, python3-tkinter 3.6.8-15.1.el8 Red Hat Enterprise Linux BaseOS (v. 8) python3 3.6.8-15.1.el8, python3-libs 3.6.8-15.1.el8, python3-test 3.6.8-15.1.el8, platform-python 3.6.8-15.1.el8
    fixed: vendor fix RHSA-2019:3520
  • Red Hat Enterprise Linux Client (v. 7) python 2.7.5-86.el7, python-libs 2.7.5-86.el7 Red Hat Enterprise Linux Client Optional (v. 7) tkinter 2.7.5-86.el7, python-test 2.7.5-86.el7, python-tools 2.7.5-86.el7 Red Hat Enterprise Linux ComputeNode (v. 7) python 2.7.5-86.el7, python-libs 2.7.5-86.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) tkinter 2.7.5-86.el7, python-test 2.7.5-86.el7, python-tools 2.7.5-86.el7 Red Hat Enterprise Linux Server (v. 7) python 2.7.5-86.el7, python-libs 2.7.5-86.el7 Red Hat Enterprise Linux Server Optional (v. 7) tkinter 2.7.5-86.el7, python-test 2.7.5-86.el7, python-tools 2.7.5-86.el7
    +2 more products
    Red Hat Enterprise Linux Workstation (v. 7) python 2.7.5-86.el7, python-libs 2.7.5-86.el7 Red Hat Enterprise Linux Workstation Optional (v. 7) tkinter 2.7.5-86.el7, python-test 2.7.5-86.el7, python-tools 2.7.5-86.el7
    fixed: vendor fix RHSA-2019:2030
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-python36-python 3.6.9-2.el6, rh-python36-python-libs 3.6.9-2.el6, rh-python36-python-test 3.6.9-2.el6, rh-python36-python-tools 3.6.9-2.el6, rh-python36-python-tkinter 3.6.9-2.el6 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python36-python 3.6.9-2.el7, rh-python36-python-libs 3.6.9-2.el7, rh-python36-python-test 3.6.9-2.el7, rh-python36-python-tools 3.6.9-2.el7, rh-python36-python-tkinter 3.6.9-2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-python36-python 3.6.9-2.el7, rh-python36-python-libs 3.6.9-2.el7, rh-python36-python-test 3.6.9-2.el7, rh-python36-python-tools 3.6.9-2.el7, rh-python36-python-tkinter 3.6.9-2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-python36-python 3.6.9-2.el7, rh-python36-python-libs 3.6.9-2.el7, rh-python36-python-test 3.6.9-2.el7, rh-python36-python-tools 3.6.9-2.el7, rh-python36-python-tkinter 3.6.9-2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python36-python 3.6.9-2.el7, rh-python36-python-libs 3.6.9-2.el7, rh-python36-python-test 3.6.9-2.el7, rh-python36-python-tools 3.6.9-2.el7, rh-python36-python-tkinter 3.6.9-2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-python36-python 3.6.9-2.el6, rh-python36-python-libs 3.6.9-2.el6, rh-python36-python-test 3.6.9-2.el6, rh-python36-python-tools 3.6.9-2.el6, rh-python36-python-tkinter 3.6.9-2.el6
    +1 more products
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python36-python 3.6.9-2.el7, rh-python36-python-libs 3.6.9-2.el7, rh-python36-python-test 3.6.9-2.el7, rh-python36-python-tools 3.6.9-2.el7, rh-python36-python-tkinter 3.6.9-2.el7
    fixed: vendor fix RHSA-2019:3725
  • Red Hat Enterprise Linux 5 python Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 8 scipy, python36, python-nose, python-wheel, python3-bson, python3-nose, +19 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last mo.

Exploit prediction

20.74% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • n/a Python

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.