Red Hat Security Advisory

RHSA-2019:1260

python27-python and python27-python-jinja2 security and bug fix update

Released 2019-05-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) python27-python-2.7.16-4.el6, python27-python-debug-2.7.16-4.el6, python27-python-devel-2.7.16-4.el6 +5
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-python-2.7.16-4.el7, python27-python-debug-2.7.16-4.el7, python27-python-devel-2.7.16-4.el7 +5
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) python27-python-2.7.16-4.el7, python27-python-debug-2.7.16-4.el7, python27-python-devel-2.7.16-4.el7 +5
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) python27-python-2.7.16-4.el7, python27-python-debug-2.7.16-4.el7, python27-python-devel-2.7.16-4.el7 +5
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) python27-python-2.7.16-4.el7, python27-python-debug-2.7.16-4.el7, python27-python-devel-2.7.16-4.el7 +5
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) python27-python-2.7.16-4.el6, python27-python-debug-2.7.16-4.el6, python27-python-devel-2.7.16-4.el6 +5
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-python-2.7.16-4.el7, python27-python-debug-2.7.16-4.el7, python27-python-devel-2.7.16-4.el7 +5

TI-2018-00980 CVE-2018-1060 · GHSA-7hp6-577h-hcgr

MEDIUM 47

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05039 Published 2018-06-18 Partial fix CWE-20

TI-2018-10510 CVE-2018-14647 · GHSA-gvw2-fvqg-v8mm

MEDIUM 46

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10911 Published 2018-09-25 Partial fix CWE-335

TI-2016-08785 CVE-2016-10745 · GHSA-hj2j-77xm-mc5v

MEDIUM 43

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.0352 Published 2019-04-08 Partial fix · 2.8.1 CWE-134

TI-2018-00981 CVE-2018-1061 · GHSA-gf62-w85x-fjpv

MEDIUM 40

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04742 Published 2018-06-19 Partial fix CWE-20

TI-2019-07132 CVE-2019-9740 · GHSA-p3j2-v862-h3v3

LOW 37

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.05408 Published 2019-03-13 Partial fix CWE-93

TI-2019-07316 CVE-2019-9947 · GHSA-89ff-5r66-wr8j

LOW 35

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.05253 Published 2019-03-23 Partial fix CWE-93