Most recent entries from all

ALSA-2019:3335 — Moderate: python27:2.7 security and bug fix update

Affected: AlmaLinux:8: python-psycopg2-doc, AlmaLinux:8: python2-Cython, AlmaLinux:8: python2-PyMySQL, AlmaLinux:8: python2-attrs, AlmaLinux:8: python2-chardet, AlmaLinux:8: python2-coverage, AlmaLinux:8: python2-dns, AlmaLinux:8: python2-docs, AlmaLinux:8: python2-docs-info, AlmaLinux:8: python2-docutils and 17 more

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

Security Fix(es):

* numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution (CVE-2019-6446)

* python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

* python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

* python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

* python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service (CVE-2019-11236)

* python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2020-01062

Withdrawn: BELL-CVE-2019-11236 — CVE-2019-11236 does not affect BellSoft software

Withdrawn by the publisher.

BREW-ansible-CVE-2019-11236 — Improper Neutralization of CRLF Sequences in urllib3 library for Python

Affected: Homebrew: ansible

In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.

certfr-2022-avi-267 — De multiples vulnérabilités ont été découvertes dans Juniper Networks Junos Space. Elles permettent à un attaquant de p…

certfr-2022-avi-267

EUVD-2026-54275

fkie_cve-2019-11236

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

GHSA-r64q-w8jr-g9qp — Improper Neutralization of CRLF Sequences in urllib3 library for Python

Affected: PyPI: urllib3

In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.

gsd-2019-11236

msrc_CVE-2019-11236 — In the urllib3 library through 1.24.1 for Python CRLF injection is possible if the attacker controls the request parame…

msrc_CVE-2019-11236

openSUSE-SU-2019:2131-1 — Security update for python-urllib3

Security update for python-urllib3

PYSEC-2019-132

Affected: PyPI: urllib3

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

RHBA-2020:1539 — Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.5.6-1 - RHEL7 Container

expat: Integer overflow leading to buffer overflow in XML_GetBuffer() libxml2: DoS caused by incorrect error detection during XZ decompression libxml2: Use after free triggered by XPointer paths beginning with range-to libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c libxml2: Unrestricted memory usage in xz_head() function in xzlib.c file: out-of-bounds read via a crafted ELF file libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c libxml2: Infinite loop caused by incorrect error detection during LZMA decompression python-requests: Redirect from HTTPS to HTTP does not remove Authorization header python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure python: Cookie domain check returns incorrect results gnome-shell: partial lock screen bypass curl: TFTP receive heap buffer overflow in tftp_receive_packet() function bash: BASH_CMD is writable in restricted bash shells python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service python: email.utils.parseaddr wrongly parses email addresses rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c ansible: shell enabled by default in a pipe lookup plugin subprocess ansible: path injection on dest parameter in fetch module ansible: atomic_move primitive sets permissive permiss…

SUSE-SU-2019:2300-1 — Security update for python-urllib3

Security update for python-urllib3

UBUNTU-CVE-2019-11236

Affected: Ubuntu:Pro:14.04:LTS: python-urllib3, Ubuntu:16.04:LTS: python-urllib3, Ubuntu:18.04:LTS: python-urllib3

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

WID-SEC-W-2022-0517 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.