Red Hat Security Advisory

RHSA-2019:2030

python security and bug fix update

Released 2019-08-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) python-2.7.5-86.el7, python-libs-2.7.5-86.el7
Red Hat Enterprise Linux Client Optional (v. 7) python-debug-2.7.5-86.el7, python-devel-2.7.5-86.el7, python-test-2.7.5-86.el7 +2
Red Hat Enterprise Linux ComputeNode (v. 7) python-2.7.5-86.el7, python-devel-2.7.5-86.el7, python-libs-2.7.5-86.el7
Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-debug-2.7.5-86.el7, python-test-2.7.5-86.el7, python-tools-2.7.5-86.el7 +1
Red Hat Enterprise Linux Server (v. 7) python-2.7.5-86.el7, python-devel-2.7.5-86.el7, python-libs-2.7.5-86.el7 +1
Red Hat Enterprise Linux Server Optional (v. 7) python-debug-2.7.5-86.el7, python-test-2.7.5-86.el7, python-tools-2.7.5-86.el7 +1
Red Hat Enterprise Linux Workstation (v. 7) python-2.7.5-86.el7, python-devel-2.7.5-86.el7, python-libs-2.7.5-86.el7
Red Hat Enterprise Linux Workstation Optional (v. 7) python-debug-2.7.5-86.el7, python-test-2.7.5-86.el7, python-tools-2.7.5-86.el7 +1

Fixes 5 records

TI-2019-07317 CVE-2019-9948 · GHSA-24p8-x4mp-cq86

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it…

MEDIUM 53

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('l…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.11844 Published 2019-03-23 Partial fix CWE-22

TI-2019-03478 CVE-2019-5010 · GHSA-jj99-2g8j-7j25

NULL pointer dereference in Python

MEDIUM 52

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.20743 Published 2019-10-31 Partial fix CWE-476

TI-2018-10510 CVE-2018-14647 · GHSA-gvw2-fvqg-v8mm

Missing initialization of resource in Python

MEDIUM 46

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10911 Published 2018-09-25 Partial fix CWE-335

TI-2019-07132 CVE-2019-9740 · GHSA-p3j2-v862-h3v3

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x…

LOW 37

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.05408 Published 2019-03-13 Partial fix CWE-93

TI-2019-07316 CVE-2019-9947 · GHSA-89ff-5r66-wr8j

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x…

LOW 35

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.05253 Published 2019-03-23 Partial fix CWE-93