Red Hat Security AdvisoryRHSA-2015:1064
python27 security, bug fix, and enhancement update
Released 2015-06-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) python27-1.1-17.el6, python27-python-2.7.8-3.el6, python27-python-debug-2.7.8-3.el6 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-1.1-20.el7, python27-python-2.7.8-3.el7, python27-python-debug-2.7.8-3.el7 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) python27-1.1-17.el6, python27-python-2.7.8-3.el6, python27-python-debug-2.7.8-3.el6 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) python27-1.1-17.el6, python27-python-2.7.8-3.el6, python27-python-debug-2.7.8-3.el6 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) python27-1.1-17.el6, python27-python-2.7.8-3.el6, python27-python-debug-2.7.8-3.el6 +11
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-1.1-20.el7, python27-python-2.7.8-3.el7, python27-python-debug-2.7.8-3.el7 +11
Fixes 5 records
Priority MEDIUM 63
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.23907 · Published 2020-02-20 · Partial fix CWE-22
Priority MEDIUM 55
Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.27229 · Published 2014-02-28 · Partial fix CWE-119
Priority LOW 39
The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03462 · Published 2020-03-11 · Partial fix
Priority LOW 37
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.07845 · Published 2017-08-24 · Partial fix · 2.6.1 CWE-129
Priority LOW 36
Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.
CVSS 2.0MEDIUM 6.4· Network · No auth · Interaction — · EPSS 0.05122 · Published 2014-10-08 · Partial fix CWE-189
THREATIST.IORead the docs