Red Hat Security AdvisoryRHSA-2020:1268
python security update
Released 2020-04-01 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) python-2.7.5-74.el7_5, python-devel-2.7.5-74.el7_5, python-libs-2.7.5-74.el7_5
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) python-debug-2.7.5-74.el7_5, python-test-2.7.5-74.el7_5, python-tools-2.7.5-74.el7_5 +1
- Red Hat Enterprise Linux Server EUS (v. 7.5) python-2.7.5-74.el7_5, python-devel-2.7.5-74.el7_5, python-libs-2.7.5-74.el7_5 +1
- Red Hat Enterprise Linux Server Optional EUS (v. 7.5) python-debug-2.7.5-74.el7_5, python-test-2.7.5-74.el7_5, python-tools-2.7.5-74.el7_5 +1
Fixes 6 records
Priority MEDIUM 53
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('l…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.11844 · Published 2019-03-23 · Partial fix CWE-22
Priority MEDIUM 47
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05039 · Published 2018-06-18 · Partial fix CWE-20
Priority MEDIUM 46
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.10911 · Published 2018-09-25 · Partial fix CWE-335
Priority MEDIUM 40
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.04742 · Published 2018-06-19 · Partial fix CWE-20
Priority LOW 37
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.05408 · Published 2019-03-13 · Partial fix CWE-93
Priority LOW 35
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.05253 · Published 2019-03-23 · Partial fix CWE-93
THREATIST.IORead the docs