7.5

CVE-2019-5010: debian debian_linux NULL Pointer Dereference

Modified
AliasesALPINE-CVE-2019-5010MGASA-2019-0084SUSE-SU-2019:0271-1
Published 31-10-2019Last modified 07-10-2026

Vulnerability summary

CVE-2019-5010 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 20.74% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
20.74%
0%100%
High · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 37 · Related 29
DLA-1663-1DLA-1834-1DLA-2280-1DLA-2337-1MGASA-2019-0135OPENSUSE-SU-2019:0155-1

Timeline

  1. 31-10-2019
    PublishedVulnerability first disclosed.
  2. 07-10-2026
    Last modifiedVulnerability information updated.

Description

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

CVSS metrics

8 scores · 5 sources · 3 versions

EPSS trend

Probability

20.74%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 20.74% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (talosintelligence.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Alpine4 products
  • python2< 2.7.15-r3
  • python2-tkinter< 2.7.15-r3
  • python3< 3.6.8-r1
  • python3-tkinter< 3.6.8-r1
Redhat4 products
Ubuntu4 products
  • python2.7< 2.7.12-1ubuntu0~16.04.8 | < 2.7.15-4ubuntu4~18.04.1
  • python3.4< 3.4.3-1ubuntu1~14.04.7+esm2
  • python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.8
  • python3.6< 3.6.8-1~18.04.2
Opensuse3 products
  • leapEOL15.1
  • python-base&distro=openSUSE Leap 15.0< 2.7.14-lp150.6.6.1
  • python&distro=openSUSE Leap 15.0< 2.7.14-lp150.6.6.1
Suse3 products
  • python-base&distro=SUSE Linux Enterprise Module for Basesystem 15< 2.7.14-7.6.1
  • python&distro=SUSE Linux Enterprise Module for Basesystem 15< 2.7.14-7.6.1
  • python&distro=SUSE Linux Enterprise Module for Desktop Applications 15< 2.7.14-7.6.1
Debian2 products
Mageia1 product
  • python< 2.7.15-1.2.mga6
Python1 product
  • python≥ 2.7.0, < 2.7.16 | ≥ 3.4.0, < 3.4.10 | ≥ 3.5.0, < 3.5.7 | ≥ 3.6.0, < 3.6.9 | ≥ 3.7.0, < 3.7.3

8 vendors · 22 products

References

25 links
Show all 25 references