Red Hat Security AdvisoryRHSA-2020:4654
python27:2.7 security update
Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-9.module+el8.1.0+3111+de3f2d8e.noarch::python27:2.7 +47
Fixes 2 records
Priority LOW 38
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03003 · Published 2020-09-04 · Partial fix · 19.2 CWE-22
Priority LOW 38
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02956 · Published 2020-07-13 · Partial fix CWE-835
