Red Hat Security Advisory

RHSA-2011:0554

python security, bug fix, and enhancement update

Released 2011-05-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 6) python-2.6.6-20.el6, python-libs-2.6.6-20.el6, tkinter-2.6.6-20.el6
Red Hat Enterprise Linux Desktop Optional (v. 6) python-2.6.6-20.el6, python-devel-2.6.6-20.el6, python-test-2.6.6-20.el6 +1
Red Hat Enterprise Linux HPC Node (v. 6) python-2.6.6-20.el6, python-libs-2.6.6-20.el6
Red Hat Enterprise Linux HPC Node Optional (v. 6) python-2.6.6-20.el6, python-devel-2.6.6-20.el6, python-test-2.6.6-20.el6 +2
Red Hat Enterprise Linux Server (v. 6) python-2.6.6-20.el6, python-devel-2.6.6-20.el6, python-docs-2.6.6-2.el6 +2
Red Hat Enterprise Linux Server Optional (v. 6) python-2.6.6-20.el6, python-test-2.6.6-20.el6, python-tools-2.6.6-20.el6 +1
Red Hat Enterprise Linux Workstation (v. 6) python-2.6.6-20.el6, python-devel-2.6.6-20.el6, python-docs-2.6.6-2.el6 +2
Red Hat Enterprise Linux Workstation Optional (v. 6) python-2.6.6-20.el6, python-test-2.6.6-20.el6, python-tools-2.6.6-20.el6

Fixes 3 records

TI-2011-01340 CVE-2011-1521 · GHSA-cq22-fw8f-mvcw

The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process…

LOW 35

The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information o…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.03564 Published 2011-05-24 Fixed CWE-399

TI-2011-00874 CVE-2011-1015 · GHSA-76v4-rfvh-v87h

The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and…

LOW 29

The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks a / (slash) character at the beginning o…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03803 Published 2011-05-09 Fixed CWE-200

TI-2010-03323 CVE-2010-3493 · GHSA-5rjw-m4xp-g2m7

Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2…

LOW 25

Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP conne…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02798 Published 2010-10-19 Fixed CWE-362