Red Hat Security AdvisoryRHSA-2015:2101
python security, bug fix, and enhancement update
Released 2015-11-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) python-2.7.5-34.el7, python-libs-2.7.5-34.el7
- Red Hat Enterprise Linux Client Optional (v. 7) python-debug-2.7.5-34.el7, python-devel-2.7.5-34.el7, python-test-2.7.5-34.el7 +2
- Red Hat Enterprise Linux ComputeNode (v. 7) python-2.7.5-34.el7, python-devel-2.7.5-34.el7, python-libs-2.7.5-34.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-debug-2.7.5-34.el7, python-test-2.7.5-34.el7, python-tools-2.7.5-34.el7 +1
- Red Hat Enterprise Linux Server (v. 7) python-2.7.5-34.el7, python-devel-2.7.5-34.el7, python-libs-2.7.5-34.el7 +1
- Red Hat Enterprise Linux Server Optional (v. 7) python-debug-2.7.5-34.el7, python-test-2.7.5-34.el7, python-tools-2.7.5-34.el7 +1
- Red Hat Enterprise Linux Workstation (v. 7) python-2.7.5-34.el7, python-devel-2.7.5-34.el7, python-libs-2.7.5-34.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) python-debug-2.7.5-34.el7, python-test-2.7.5-34.el7, python-tools-2.7.5-34.el7 +1
Fixes 4 records
Priority MEDIUM 63
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.23907 · Published 2020-02-20 · Partial fix CWE-22
Priority LOW 39
The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03462 · Published 2020-03-11 · Partial fix
Priority LOW 37
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.07845 · Published 2017-08-24 · Partial fix · 2.6.1 CWE-129
Priority LOW 36
Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.
CVSS 2.0MEDIUM 6.4· Network · No auth · Interaction — · EPSS 0.05122 · Published 2014-10-08 · Partial fix CWE-189
THREATIST.IORead the docs