Red Hat Security AdvisoryRHSA-2020:4299
rh-python38 security, bug fix, and enhancement update
Released 2020-10-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
Fixes 5 records
Priority MEDIUM 47
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF cont…
CVSS 3.1HIGH 7.2· Network · No auth · No interaction · EPSS 0.06358 · Published 2020-09-27 · Partial fix CWE-74
Priority MEDIUM 47
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by t…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.12706 · Published 2020-06-18 · Partial fix CWE-330
Priority LOW 39
psutil (aka python-psutil) through 5.6.5 can have a double free.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03522 · Published 2019-11-12 · Partial fix · 5.6.6 CWE-415
Priority LOW 38
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02956 · Published 2020-07-13 · Partial fix CWE-835
Priority LOW 33
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest().
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02269 · Published 2020-09-29 · Partial fix · 1.25.9 CWE-74
THREATIST.IORead the docs