An update of the python2 package has been released.

A vulnerability has been discovered in Python, an interactive high-level object-oriented language, that is relevant for cookie handling. By using a malicious server an attacker might steal cookies that are meant for other domains

For Debian 8 'Jessie', this problem has been fixed in version 2.7.9-2+deb8u4.

We recommend that you upgrade your python2.7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4127-1 advisory.

    It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use     this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS     and Ubuntu 18.04 LTS. (CVE-2018-20406)

    It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could     possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852)

    Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding     during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information.
    (CVE-2019-9636, CVE-2019-10160)

    Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates.
    An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This     issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010)

    It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this     issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947)

    Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could     possibly use this issue to bypass blocklist meschanisms. (CVE-2019-9948)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Python 2.7.17 is a bug fix release in the Python 2.7.x series. It is expected to be the penultimate release for Python 2.7.

https://www.python.org/downloads/release/python-2717/

  - Security fix for CVE-2018-20852.

  - Security fix for CVE-2019-16056.

  - Security fix for CVE-2019-16935.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The documentation XML-RPC server in Python through     2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in     Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title     is called with untrusted input, arbitrary JavaScript     can be delivered to clients that visit the http URL for     this server.(CVE-2019-16935)

  - http.cookiejar.DefaultPolicy.domain_return_ok in     Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into     sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a     hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for     example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP     connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x     through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7,     3.6.x before 3.6.9, and 3.7.x before     3.7.3.(CVE-2018-20852)

  - An issue was discovered in Python through 2.7.16, 3.x     through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through     3.7.4. The email module wrongly parses email addresses     that contain multiple @ characters. An application that     uses the email module and implements some kind of     checks on the From/To headers of a message could be     tricked into accepting an email address that should be     denied. An attack may be the same as in CVE-2019-11340     however, this CVE applies to Python more     generally.(CVE-2019-16056)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - http.cookiejar.DefaultPolicy.domain_return_ok in     Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into     sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a     hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for     example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP     connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x     through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7,     3.6.x before 3.6.9, and 3.7.x before     3.7.3.(CVE-2018-20852)

  - An issue was discovered in urllib2 in Python 2.x     through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the first argument to     urllib.request.urlopen with \r\n (specifically in the     path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is     similar to the CVE-2019-9740 query string     issue.(CVE-2019-9947)

  - An issue was discovered in urllib2 in Python 2.x     through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the first argument to     urllib.request.urlopen with \r\n (specifically in the     query string after a ? character) followed by an HTTP     header or a Redis command.(CVE-2019-9740)

  - An issue was discovered in Python through 2.7.16, 3.x     through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through     3.7.4. The email module wrongly parses email addresses     that contain multiple @ characters. An application that     uses the email module and implements some kind of     checks on the From/To headers of a message could be     tricked into accepting an email address that should be     denied. An attack may be the same as in CVE-2019-11340     however, this CVE applies to Python more     generally.(CVE-2019-16056)

  - The documentation XML-RPC server in Python through     2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in     Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title     is called with untrusted input, arbitrary JavaScript     can be delivered to clients that visit the http URL for     this server.(CVE-2019-16935)

  - library/glob.html in the Python 2 and 3 documentation     before 2016 has potentially misleading information     about whether sorting occurs, as demonstrated by     irreproducible cancer-research results. NOTE: the     effects of this documentation cross application     domains, and thus it is likely that security-relevant     code elsewhere is affected. This issue is not a Python     implementation bug, and there are no reports that NMR     researchers were specifically relying on     library/glob.html. In other words, because the older     documentation stated 'finds all the pathnames matching     a specified pattern according to the rules used by the     Unix shell,' one might have incorrectly inferred that     the sorting that occurs in a Unix shell also occurred     for glob.glob. There is a workaround in newer versions     of Willoughby nmr-data_compilation-p2.py and     nmr-data_compilation-p3.py, which call sort()     directly.(CVE-2019-17514)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1131 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Cookie domain check returns incorrect results (CVE-2018-20852)

    * python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

* python: Cookie domain check returns incorrect results * python:
email.utils.parseaddr wrongly parses email addresses

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1432 advisory.

    http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before     3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.(CVE-2018-20852)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.01, has python3 packages installed that are affected by multiple vulnerabilities:

  - http.cookiejar.DefaultPolicy.domain_return_ok in     Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into     sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a     hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for     example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP     connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x     through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7,     3.6.x before 3.6.9, and 3.7.x before 3.7.3.
    (CVE-2018-20852)

  - An issue was discovered in Python through 2.7.16, 3.x     through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through     3.7.4. The email module wrongly parses email addresses     that contain multiple @ characters. An application that     uses the email module and implements some kind of checks     on the From/To headers of a message could be tricked     into accepting an email address that should be denied.
    An attack may be the same as in CVE-2019-11340; however,     this CVE applies to Python more generally.
    (CVE-2019-16056)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1605 advisory.

    Python is an interpreted, interactive, object-oriented programming language that supports modules,     classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a     stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and     PostgreSQL.

    The following packages have been upgraded to a later upstream version: python2 (2.7.17). (BZ#1759944)

    Security Fix(es):

    * python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure     (CVE-2018-20060)

    * python: Cookie domain check returns incorrect results (CVE-2018-20852)

    * python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on     internal service (CVE-2019-11236)

    * python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

    * python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

    * python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
128158	Photon OS 3.0: Python2 PHSA-2019-3.0-0024	Nessus	PhotonOS Local Security Checks	8/26/2019	8/22/2025	medium
128426	Debian DLA-1906-1 : python2.7 security update	Nessus	Debian Local Security Checks	9/3/2019	4/30/2024	medium
128631	Ubuntu 16.04 LTS / 18.04 LTS : Python vulnerabilities (USN-4127-1)	Nessus	Ubuntu Local Security Checks	9/10/2019	9/3/2025	critical
130776	Fedora 31 : python2 / python2-docs (2019-0d3fcae639)	Nessus	Fedora Local Security Checks	11/12/2019	4/12/2024	high
130823	EulerOS 2.0 SP8 : python2 (EulerOS-SA-2019-2114)	Nessus	Huawei Local Security Checks	11/12/2019	4/12/2024	high
134501	EulerOS Virtualization for ARM 64 3.0.2.0 : python (EulerOS-SA-2020-1212)	Nessus	Huawei Local Security Checks	3/13/2020	3/22/2024	high
135059	RHEL 7 : python (RHSA-2020:1131)	Nessus	Red Hat Local Security Checks	4/1/2020	11/7/2024	high
135830	Scientific Linux Security Update : python3 on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	4/21/2020	3/15/2024	high
137089	Amazon Linux 2 : python, --advisory ALAS2-2020-1432 (ALAS-2020-1432)	Nessus	Amazon Linux Local Security Checks	6/4/2020	10/1/2025	medium
138767	NewStart CGSL MAIN 6.01 : python3 Multiple Vulnerabilities (NS-SA-2020-0030)	Nessus	NewStart CGSL Local Security Checks	7/21/2020	2/29/2024	high
136044	RHEL 8 : python27:2.7 (RHSA-2020:1605)	Nessus	Red Hat Local Security Checks	4/28/2020	3/13/2025	critical

Detections

Analytics

Plugins Search

medium

medium

critical

high

high

high

high

high

medium

high

critical