Red Hat Security AdvisoryRHSA-2020:4273
python27 security, bug fix, and enhancement update
Released 2020-10-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
Fixes 4 records
Priority MEDIUM 47
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF cont…
CVSS 3.1HIGH 7.2· Network · No auth · No interaction · EPSS 0.06358 · Published 2020-09-27 · Partial fix CWE-74
Priority LOW 38
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03003 · Published 2020-09-04 · Partial fix · 19.2 CWE-22
Priority LOW 38
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02956 · Published 2020-07-13 · Partial fix CWE-835
Priority LOW 33
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03513 · Published 2019-10-23 · Partial fix CWE-74
THREATIST.IORead the docs