Red Hat Security AdvisoryRHSA-2020:1132
python3 security update
Released 2020-03-31 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) python3-3.6.8-13.el7, python3-libs-3.6.8-13.el7
- Red Hat Enterprise Linux Client Optional (v. 7) python3-3.6.8-13.el7, python3-debug-3.6.8-13.el7, python3-devel-3.6.8-13.el7 +3
- Red Hat Enterprise Linux ComputeNode (v. 7) python3-3.6.8-13.el7, python3-libs-3.6.8-13.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) python3-3.6.8-13.el7, python3-debug-3.6.8-13.el7, python3-devel-3.6.8-13.el7 +3
- Red Hat Enterprise Linux Server (v. 7) python3-3.6.8-13.el7, python3-libs-3.6.8-13.el7, python3-libs-3.6.8-13.el7.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) python3-3.6.8-13.el7, python3-3.6.8-13.el7.ppc, python3-debug-3.6.8-13.el7 +9
- Red Hat Enterprise Linux Workstation (v. 7) python3-3.6.8-13.el7, python3-libs-3.6.8-13.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) python3-3.6.8-13.el7, python3-debug-3.6.8-13.el7, python3-devel-3.6.8-13.el7 +3
Fixes 2 records
Priority MEDIUM 47
An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0512 · Published 2019-09-06 · Partial fix CWE-20
Priority LOW 26
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.03668 · Published 2019-07-13 · Partial fix CWE-20
