Amazon Linux AMI : python34 (ALAS-2020-1429)

medium Nessus Plugin ID 140089
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1429 advisory.

- In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings. (CVE-2016-10739)

- An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue.
(This is not exploitable when glibc has CVE-2016-10739 fixed.) (CVE-2019-18348)

- In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

- An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. (CVE-2019-9740)

- An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
(CVE-2019-9947)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update python34' to update your system.
Run 'yum update python35' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2020-1429.html

https://access.redhat.com/security/cve/CVE-2019-18348

https://access.redhat.com/security/cve/CVE-2019-20907

Plugin Details

Severity: Medium

ID: 140089

File Name: ala_ALAS-2020-1429.nasl

Version: 1.3

Type: local

Agent: unix

Published: 8/31/2020

Updated: 2/19/2021

Dependencies: ssh_get_info.nasl

Risk Information

CVSS Score Source: CVE-2016-10739

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:python34, p-cpe:/a:amazon:linux:python34-debuginfo, p-cpe:/a:amazon:linux:python34-devel, p-cpe:/a:amazon:linux:python34-libs, p-cpe:/a:amazon:linux:python34-test, p-cpe:/a:amazon:linux:python34-tools, p-cpe:/a:amazon:linux:python35, p-cpe:/a:amazon:linux:python35-debuginfo, p-cpe:/a:amazon:linux:python35-devel, p-cpe:/a:amazon:linux:python35-libs, p-cpe:/a:amazon:linux:python35-test, p-cpe:/a:amazon:linux:python35-tools, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/27/2020

Vulnerability Publication Date: 1/21/2019

Reference Information

CVE: CVE-2016-10739, CVE-2019-9740, CVE-2019-9947, CVE-2019-18348, CVE-2019-20907

BID: 106672, 107466, 107555

ALAS: 2020-1429

IAVA: 2020-A-0340-S