Most recent entries from all

ALSA-2020:1605 — Moderate: python27:2.7 security, bug fix, and enhancement update

Affected: AlmaLinux:8: python-psycopg2-doc, AlmaLinux:8: python2-Cython, AlmaLinux:8: python2-PyMySQL, AlmaLinux:8: python2-attrs, AlmaLinux:8: python2-chardet, AlmaLinux:8: python2-coverage, AlmaLinux:8: python2-dns, AlmaLinux:8: python2-docs, AlmaLinux:8: python2-docs-info, AlmaLinux:8: python2-docutils and 18 more

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

The following packages have been upgraded to a later upstream version: python2 (2.7.17). (BZ#1759944)

Security Fix(es):

* python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060)

* python: Cookie domain check returns incorrect results (CVE-2018-20852)

* python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

* python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

* python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

* python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-00373

Withdrawn: BELL-CVE-2018-20852 — CVE-2018-20852 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2022-avi-267 — De multiples vulnérabilités ont été découvertes dans Juniper Networks Junos Space. Elles permettent à un attaquant de p…

certfr-2022-avi-267

cnvd-2019-26812

EUVD-2026-70600

fkie_cve-2018-20852

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

GHSA-p5ff-6x75-2mgp

gsd-2018-20852

openSUSE-SU-2019:1988-1 — Security update for python

Security update for python

RHBA-2020:1539 — Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.5.6-1 - RHEL7 Container

expat: Integer overflow leading to buffer overflow in XML_GetBuffer() libxml2: DoS caused by incorrect error detection during XZ decompression libxml2: Use after free triggered by XPointer paths beginning with range-to libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c libxml2: Unrestricted memory usage in xz_head() function in xzlib.c file: out-of-bounds read via a crafted ELF file libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c libxml2: Infinite loop caused by incorrect error detection during LZMA decompression python-requests: Redirect from HTTPS to HTTP does not remove Authorization header python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure python: Cookie domain check returns incorrect results gnome-shell: partial lock screen bypass curl: TFTP receive heap buffer overflow in tftp_receive_packet() function bash: BASH_CMD is writable in restricted bash shells python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service python: email.utils.parseaddr wrongly parses email addresses rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c ansible: shell enabled by default in a pipe lookup plugin subprocess ansible: path injection on dest parameter in fetch module ansible: atomic_move primitive sets permissive permiss…

SUSE-SU-2019:14142-1 — Security update for python

Security update for python

UBUNTU-CVE-2018-20852

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:16.04:LTS: python2.7, Ubuntu:16.04:LTS: python3.5, Ubuntu:18.04:LTS: python2.7, Ubuntu:18.04:LTS: python3.6

WID-SEC-W-2024-1597 — Python: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um Informationen offenzulegen.