This update for python3 fixes the following issues :

  - Fixed CVE-2020-27619 (bsc#1178009), where     Lib/test/multibytecodec_support calls eval() on content     retrieved via HTTP.

  - Change setuptools and pip version numbers according to     new wheels

  - Handful of changes to make python36 compatible with     SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738)

  - add triplets for mips-r6 and riscv

  - RISC-V needs CTYPES_PASS_BY_REF_HACK

Update to 3.6.12 (bsc#1179193)

  - Ensure python3.dll is loaded from correct locations when     Python is embedded

  - The __hash__() methods of ipaddress.IPv4Interface and     ipaddress.IPv6Interface incorrectly generated constant     hash values of 32 and 128 respectively. This resulted in     always causing hash collisions. The fix uses hash() to     generate hash values for the tuple of (address, mask     length, network address).

  - Prevent http header injection by rejecting control     characters in http.client.putrequest(&hellip;).

  - Unpickling invalid NEWOBJ_EX opcode with the C     implementation raises now UnpicklingError instead of     crashing.

  - Avoid infinite loop when reading specially crafted TAR     files using the tarfile module

  - This release also fixes CVE-2020-26116 (bsc#1177211) and     CVE-2019-20907 (bsc#1174091).

Update to 3.6.11 :

  - Disallow CR or LF in email.headerregistry. Address     arguments to guard against header injection attacks.

  - Disallow control characters in hostnames in http.client,     addressing CVE-2019-18348. Such potentially malicious     header injection URLs now cause a InvalidURL to be     raised. (bsc#1155094)

  - CVE-2020-8492: The AbstractBasicAuthHandler class of the     urllib.request module uses an inefficient regular     expression which can be exploited by an attacker to     cause a denial of service. Fix the regex to prevent the     catastrophic backtracking. Vulnerability reported by Ben     Caller and Matt Schwager.

This update was imported from the SUSE:SLE-15:Update update project.

An update of the python2 package has been released.

Security fix for CVE-2019-5010

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 fixes the following issues :

Security issue fixed :

CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191)

CVE-2018-20406: Fixed a integer overflow via a large LONG_BINPUT (bsc#1120644)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

Security issues fixed :

  - CVE-2019-5010: Fixed a denial-of-service vulnerability     in the X509 certificate parser (bsc#1122191).

  - CVE-2018-14647: Fixed a denial-of-service vulnerability     in Expat (bsc#1109847).

Non-security issue fixed :

  - Fixed a bug where PyWeakReference struct was not     initialized correctly leading to a crash (bsc#1073748).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Python Changelog :

bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet of Cisco.

Last upstream Python 3.4 security release, 3.4.10. Security fix for CVE-2019-9636, CVE-2019-5010, CVE-2018-20406.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update legacy Python to 2.7.16. Most significant improvement is that is builds against OpenSSL 1.1.1. See [upstream release announcement](https://www.python.org/downloads/release/python-2716/) and [changelog](https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7 .16.rst) (+ [rc1 changelog](https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.
16rc1.rst)).

Fixes the following CVEs :

  -     [CVE-2019-5010](https://access.redhat.com/security/cve/c     ve-2019-5010) Fix a NULL pointer deref in ssl module.
    The cert parser did not handle CRL distribution points     with empty DP or URI correctly. A malicious or buggy     certificate can result into segfault. Vulnerability     (TALOS-2018-0758) reported by Colin Read and Nicolas     Edet of Cisco.

  -     [CVE-2013-1752](https://access.redhat.com/security/cve/c     ve-2013-1752): Change use of readline() in     `imaplib.IMAP4_SSL` to limit line length.

([CVE-2018-14647](https://access.redhat.com/security/cve/cve-2018-1464 7) is listed in upstream changelog, but it was already backported in Fedora.)

Note that Python 2 is deprecated in Fedora 30 and users are advised to switch to Python 3. Upstream support of Python 2 ends on 2020-01-01.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Python is an interpreted, interactive, object-oriented     programming language often compared to Tcl, Perl,     Scheme or Java. Python includes modules, classes,     exceptions, very high level dynamic data types and     dynamic typing. Python supports interfaces to many     system calls and libraries, as well as to various     windowing systems (X11, Motif, Tk, Mac and     MFC).Programmers can write new built-in modules for     Python in C or C++. Python can be used as an extension     language for applications that need a programmable     interface.Note that documentation for Python is     provided in the python-docsSecurity Fix(es): Python's     elementtree C accelerator failed to initialise Expat's     hash salt during initialization. This could make it     easy to conduct denial of service attacks against Expat     by constructing an XML document that would cause     pathological hash collisions in Expat's internal data     structures, consuming large amounts CPU and     RAM.(CVE-2018-14647)An exploitable denial-of-service     vulnerability exists in the X509 certificate parser of     Python.org Python 2.7.11 / 3.6.6. A specially crafted     X509 certificate can cause a NULL pointer dereference,     resulting in a denial of service. An attacker can     initiate or accept TLS connections using crafted     certificates to trigger this     vulnerability.(CVE-2019-5010)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 to version 3.6.10 fixes the following issues :

CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).

CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).

CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 to version 3.6.10 fixes the following issues :

  - CVE-2017-18207: Fixed a denial of service in     Wave_read._read_fmt_chunk() (bsc#1083507).

  - CVE-2019-16056: Fixed an issue where email parsing could     fail for multiple @ (bsc#1149955).

  - CVE-2019-15903: Fixed a heap-based buffer over-read in     libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
145326	openSUSE Security Update : python3 (openSUSE-2020-2332)	Nessus	SuSE Local Security Checks	1/25/2021	1/26/2024	critical
132534	Photon OS 2.0: Python2 PHSA-2019-2.0-0190	Nessus	PhotonOS Local Security Checks	12/31/2019	7/22/2024	high
121402	Fedora 28 : python37 (2019-b8ffb3768d)	Nessus	Fedora Local Security Checks	1/28/2019	6/25/2024	high
121616	SUSE SLED12 / SLES12 Security Update : python3 (SUSE-SU-2019:0243-1)	Nessus	SuSE Local Security Checks	2/6/2019	6/24/2024	high
122642	openSUSE Security Update : python (openSUSE-2019-292)	Nessus	SuSE Local Security Checks	3/6/2019	6/17/2024	high
123144	FreeBSD : Python -- NULL pointer dereference vulnerability (d74371d2-4fee-11e9-a5cd-1df8a848de3d)	Nessus	FreeBSD Local Security Checks	3/27/2019	6/12/2024	high
123475	Fedora 29 : python34 (2019-6b02154aa0)	Nessus	Fedora Local Security Checks	3/29/2019	6/7/2024	critical
124470	Fedora 30 : python2 / python2-docs (2019-0c91ce7b3c)	Nessus	Fedora Local Security Checks	5/2/2019	5/30/2024	high
125578	EulerOS Virtualization for ARM 64 3.0.2.0 : python (EulerOS-SA-2019-1626)	Nessus	Huawei Local Security Checks	5/30/2019	5/17/2024	high
133036	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	1/17/2020	3/29/2024	critical
133172	openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	1/22/2020	3/29/2024	critical

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

critical

high

high

critical

critical