Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4754-3 advisory.

  - Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource     consumption) via a ZIP bomb. (CVE-2019-9674)

  - library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information     about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects     of this documentation cross application domains, and thus it is likely that security-relevant code     elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR     researchers were specifically relying on library/glob.html. In other words, because the older     documentation stated finds all the pathnames matching a specified pattern according to the rules used by     the Unix shell, one might have incorrectly inferred that the sorting that occurs in a Unix shell also     occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py     and nmr-data_compilation-p3.py, which call sort() directly. (CVE-2019-17514)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

  - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

  - In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content     retrieved via HTTP. (CVE-2020-27619)

  - Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to     remote code execution in certain Python applications that accept floating-point numbers as untrusted     input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used     unsafely. (CVE-2021-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this information. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2019-17514) It was discovered that Python incorrectly handled certain TAR archives. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-20907) It was discovered that incorrectly handled certain ZIP files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9674) It was discovered that Python incorrectly handled certain IP values. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14422).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python to version 2.7.17 fixes the following issues :

Syncing with lots of upstream bug fixes and security fixes.

Bug fixes :

CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825).

CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094).

CVE-2020-8492: Fixed a regular expression in urllib that was prone to denial of service via HTTP (bsc#1162367).

Fixed mismatches between libpython and python-base versions (bsc#1162224).

Fixed segfault in libpython2.7.so.1 (bsc#1073748).

Unified packages among openSUSE:Factory and SLE versions (bsc#1159035).

Added idle.desktop and idle.appdata.xml to provide IDLE in menus (bsc#1153830).

Excluded tsl_check files from python-base to prevent file conflict with python-strict-tls-checks package (bsc#945401).

Changed the name of idle3 icons to idle3.png to avoid collision with Python 2 version (bsc#1165894).

Additionally a new 'shared-python-startup' package is provided containing startup files.

python-rpm-macros was updated to fix :

Do not write .pyc files for tests (bsc#1171561)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

  - ** DISPUTED ** The Wave_read._read_fmt_chunk function     in Lib/wave.py in Python through 3.6.4 does not ensure     a nonzero channel value, which allows attackers to     cause a denial of service (divide-by-zero and     exception) via a crafted wav format audio file. NOTE:
    the vendor disputes this issue because Python     applications 'need to be prepared to handle a wide     variety of exceptions.'(CVE-2017-18207)

  - Python Software Foundation Python (CPython) version 2.7     contains a CWE-77: Improper Neutralization of Special     Elements used in a Command ('Command Injection')     vulnerability in shutil module (make_archive function)     that can result in Denial of service, Information gain     via injection of arbitrary files on the system or     entire drive. This attack appear to be exploitable via     Passage of unfiltered user input to the function. This     vulnerability appears to have been fixed in after     commit     add531a1e55b0a739b0f42582f1c9747e5649ace.(CVE-2018-1000     802)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

Security issues fixed :

  - CVE-2019-18348: Fixed a CRLF injection via the host part     of the url passed to urlopen(). Now an InvalidURL     exception is raised (bsc#1155094).

  - CVE-2019-9674: Improved the documentation to reflect the     dangers of zip-bombs (bsc#1162825).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues :

Security issues fixed :

CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094).

CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Python Software Foundation Python (CPython) version 2.7     contains a CWE-77: Improper Neutralization of Special     Elements used in a Command ('Command Injection')     vulnerability in shutil module (make_archive function)     that can result in Denial of service, Information gain     via injection of arbitrary files on the system or     entire drive. This attack appear to be exploitable via     Passage of unfiltered user input to the function. This     vulnerability appears to have been fixed in after     commit     add531a1e55b0a739b0f42582f1c9747e5649ace.(CVE-2018-1000     802)

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Python Software Foundation Python (CPython) version 2.7     contains a CWE-77: Improper Neutralization of Special     Elements used in a Command ('Command Injection')     vulnerability in shutil module (make_archive function)     that can result in Denial of service, Information gain     via injection of arbitrary files on the system or     entire drive. This attack appear to be exploitable via     Passage of unfiltered user input to the function. This     vulnerability appears to have been fixed in after     commit     add531a1e55b0a739b0f42582f1c9747e5649ace.(CVE-2018-1000     802)

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Wave_read._read_fmt_chunk function in Lib/wave.py     in Python through 3.6.4 does not ensure a nonzero     channel value, which allows attackers to cause a denial     of service (divide-by-zero and exception) via a crafted     wav format audio file. NOTE: the vendor disputes this     issue because Python applications 'need to be prepared     to handle a wide variety of     exceptions.'(CVE-2017-18207)

  - Python Software Foundation Python (CPython) version 2.7     contains a CWE-77: Improper Neutralization of Special     Elements used in a Command ('Command Injection')     vulnerability in shutil module (make_archive function)     that can result in Denial of service, Information gain     via injection of arbitrary files on the system or     entire drive. This attack appear to be exploitable via     Passage of unfiltered user input to the function. This     vulnerability appears to have been fixed in after     commit     add531a1e55b0a739b0f42582f1c9747e5649ace.(CVE-2018-1000     802)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the python3 package has been released.

This update for python3 fixes the following issue :

CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094).

CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825).

CVE-2020-8492: Fixed a regular expression in urllib that was prone to denial of service via HTTP (bsc#1162367).

Fixed an issue with version missmatch (bsc#1162224).

Rename idle icons to idle3 in order to not conflict with python2 variant of the package. (bsc#1165894)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python3 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Python (CPython) 3.6 through 3.6.10, 3.7 through     3.7.6, and 3.8 through 3.8.1, an insecure dependency     load upon launch on Windows 7 may result in an     attacker's copy of api-ms-win-core-path-l1-1-0.dll     being loaded and used instead of the system's copy.
    Windows 8 and later are unaffected.(CVE-2020-8315)

  - do_ed_script in pch.c in GNU patch through 2.7.6 does     not block strings beginning with a ! character. NOTE:
    this is the same commit as for CVE-2019-13638, but the     ! syntax is specific to ed, and is unrelated to a shell     metacharacter.(CVE-2019-9674)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A ZIP bomb attack was found in the Python zipfile     module. A remote attacker could abuse this flaw by     providing a specially crafted ZIP file that, when     decompressed by zipfile, would exhaust system resources     resulting in a denial of service.(CVE-2019-9674)

  - The Wave_read._read_fmt_chunk function in Lib/wave.py     in Python through 3.6.4 does not ensure a nonzero     channel value, which allows attackers to cause a denial     of service (divide-by-zero and exception) via a crafted     wav format audio file. NOTE: the vendor disputes this     issue because Python applications 'need to be prepared     to handle a wide variety of     exceptions.'(CVE-2017-18207)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python36 fixes the following issues :

Security issues fixed :

CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825).

CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP (bsc#1162367).

Non-security issue fixed: If the locale is 'C', coerce it to C.UTF-8 (bsc#1162423).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 fixes the following issues :

Security issues fixed :

  - CVE-2019-9674: Improved the documentation to reflect the     dangers of zip-bombs (bsc#1162825).

  - CVE-2020-8492: Fixed a regular expression in urrlib that     was prone to denial of service via HTTP (bsc#1162367).

Non-security issue fixed :

  - If the locale is 'C', coerce it to C.UTF-8     (bsc#1162423).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues :

Security issues fixed :

CVE-2019-9674: Improved the documentation, warning about dangers of zip-bombs (bsc#1162825).

CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP (bsc#1162367).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the python2 package has been released.

This update for python3 fixes the following issues :

Security issues fixed :

CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825).

CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP (bsc#1162367).

Non-security issue fixed: If the locale is 'C', coerce it to C.UTF-8 (bsc#1162423).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

  - In Python (CPython) 3.6 through 3.6.10, 3.7 through     3.7.6, and 3.8 through 3.8.1, an insecure dependency     load upon launch on Windows 7 may result in an     attacker's copy of api-ms-win-core-path-l1-1-0.dll     being loaded and used instead of the system's copy.
    Windows 8 and later are unaffected.(CVE-2020-8315)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

  - Python Software Foundation Python (CPython) version 2.7     contains a CWE-77: Improper Neutralization of Special     Elements used in a Command ('Command Injection')     vulnerability in shutil module (make_archive function)     that can result in Denial of service, Information gain     via injection of arbitrary files on the system or     entire drive. This attack appear to be exploitable via     Passage of unfiltered user input to the function. This     vulnerability appears to have been fixed in after     commit     add531a1e55b0a739b0f42582f1c9747e5649ace.(CVE-2018-1000     802)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
148008	Ubuntu 18.04 LTS / 20.04 LTS : Python vulnerabilities (USN-4754-3)	Nessus	Ubuntu Local Security Checks	critical
138872	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Python vulnerabilities (USN-4428-1)	Nessus	Ubuntu Local Security Checks	high
137580	SUSE SLES12 Security Update : python (SUSE-SU-2020:1524-1)	Nessus	SuSE Local Security Checks	medium
137488	EulerOS 2.0 SP2 : python (EulerOS-SA-2020-1646)	Nessus	Huawei Local Security Checks	critical
136884	openSUSE Security Update : python (openSUSE-2020-696)	Nessus	SuSE Local Security Checks	medium
136798	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:1339-1)	Nessus	SuSE Local Security Checks	medium
136219	EulerOS Virtualization for ARM 64 3.0.2.0 : python (EulerOS-SA-2020-1516)	Nessus	Huawei Local Security Checks	critical
135634	EulerOS Virtualization 3.0.2.2 : python (EulerOS-SA-2020-1472)	Nessus	Huawei Local Security Checks	critical
135556	EulerOS 2.0 SP3 : python (EulerOS-SA-2020-1427)	Nessus	Huawei Local Security Checks	critical
135310	Photon OS 2.0: Python3 PHSA-2020-2.0-0224	Nessus	PhotonOS Local Security Checks	high
135197	SUSE SLES12 Security Update : python3 (SUSE-SU-2020:0854-1)	Nessus	SuSE Local Security Checks	medium
135133	EulerOS Virtualization for ARM 64 3.0.6.0 : python3 (EulerOS-SA-2020-1346)	Nessus	Huawei Local Security Checks	medium
135131	EulerOS Virtualization for ARM 64 3.0.6.0 : python2 (EulerOS-SA-2020-1344)	Nessus	Huawei Local Security Checks	high
134286	SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0557-1)	Nessus	SuSE Local Security Checks	high
134197	openSUSE Security Update : python3 (openSUSE-2020-274)	Nessus	SuSE Local Security Checks	high
134159	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0510-1)	Nessus	SuSE Local Security Checks	high
134086	Photon OS 2.0: Python2 PHSA-2020-2.0-0211	Nessus	PhotonOS Local Security Checks	high
134081	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0467-1)	Nessus	SuSE Local Security Checks	high
134041	Photon OS 1.0: Python2 PHSA-2020-1.0-0280	Nessus	PhotonOS Local Security Checks	high
134009	EulerOS 2.0 SP8 : python3 (EulerOS-SA-2020-1175)	Nessus	Huawei Local Security Checks	medium
134008	EulerOS 2.0 SP8 : python2 (EulerOS-SA-2020-1174)	Nessus	Huawei Local Security Checks	high
133927	EulerOS 2.0 SP5 : python (EulerOS-SA-2020-1126)	Nessus	Huawei Local Security Checks	critical
133809	Photon OS 3.0: Python2 PHSA-2020-3.0-0057	Nessus	PhotonOS Local Security Checks	high
133685	Photon OS 1.0: Python3 PHSA-2020-1.0-0276	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2019-9674

high

Tenable Plugins

critical

high

medium

critical

medium

medium

critical

critical

critical

high

medium

medium

high

high

high

high

high

high

high

medium

high

critical

high

high