CVE-2019-5010

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 20.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-10-31 · updated 2026-10-07
Weakness: CWE-476

Description

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

Affected products

Debian Linux: 9.0
openSUSE Leap: 15.1
Python: from 2.7.0 before 2.7.16; from 3.4.0 before 3.4.10; from 3.5.0 before 3.5.7; from 3.6.0 before 3.6.9; from 3.7.0 before 3.7.3 — fixed in 2.7.16, 3.4.10, 3.5.7, 3.6.9, 3.7.3
Red Hat Enterprise Linux: 8.0
RedHat Enterprise Linux Eus: 8.1, 8.2, 8.4, 8.6
RedHat Enterprise Linux Server Aus: 8.2, 8.4, 8.6
RedHat Enterprise Linux Server Tus: 8.2, 8.4, 8.6

How to fix

Upgrade to a fixed version: Python 2.7.16, 3.4.10, 3.5.7, 3.6.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-5010 or the next vulnerability affects your stack