Security fix for CVE-2018-1000802

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The Wave_read._read_fmt_chunk function in Lib/wave.py     in Python through 3.6.4 does not ensure a nonzero     channel value, which allows attackers to cause a denial     of service (divide-by-zero and exception) via a crafted     wav format audio file. NOTE: the vendor disputes this     issue because Python applications 'need to be prepared     to handle a wide variety of     exceptions.'(CVE-2017-18207)

  - Python Software Foundation Python (CPython) version 2.7     contains a CWE-77: Improper Neutralization of Special     Elements used in a Command ('Command Injection')     vulnerability in shutil module (make_archive function)     that can result in Denial of service, Information gain     via injection of arbitrary files on the system or     entire drive. This attack appear to be exploitable via     Passage of unfiltered user input to the function. This     vulnerability appears to have been fixed in after     commit     add531a1e55b0a739b0f42582f1c9747e5649ace.(CVE-2018-1000     802)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

  - ** DISPUTED ** The Wave_read._read_fmt_chunk function     in Lib/wave.py in Python through 3.6.4 does not ensure     a nonzero channel value, which allows attackers to     cause a denial of service (divide-by-zero and     exception) via a crafted wav format audio file. NOTE:
    the vendor disputes this issue because Python     applications 'need to be prepared to handle a wide     variety of exceptions.'(CVE-2017-18207)

  - Python Software Foundation Python (CPython) version 2.7     contains a CWE-77: Improper Neutralization of Special     Elements used in a Command ('Command Injection')     vulnerability in shutil module (make_archive function)     that can result in Denial of service, Information gain     via injection of arbitrary files on the system or     entire drive. This attack appear to be exploitable via     Passage of unfiltered user input to the function. This     vulnerability appears to have been fixed in after     commit     add531a1e55b0a739b0f42582f1c9747e5649ace.(CVE-2018-1000     802)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
120704	Fedora 29 : python2 (2018-ae70d262b0)	Nessus	Fedora Local Security Checks	1/3/2019	7/1/2024	critical
135556	EulerOS 2.0 SP3 : python (EulerOS-SA-2020-1427)	Nessus	Huawei Local Security Checks	4/15/2020	3/18/2024	critical
137488	EulerOS 2.0 SP2 : python (EulerOS-SA-2020-1646)	Nessus	Huawei Local Security Checks	6/17/2020	3/6/2024	critical
117843	Fedora 27 : python2 (2018-c3a5b2029a)	Nessus	Fedora Local Security Checks	10/1/2018	8/1/2024	critical
133259	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	1/27/2020	3/28/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical