Red Hat Security AdvisoryRHSA-2021:3254
rh-python38 security, bug fix, and enhancement update
Released 2021-08-24 · Red Hat rating Moderate · View on Red Hat →
Fixes 16 records
Priority HIGH 82
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demons…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.24002 · Published 2021-01-19 · Partial fix CWE-120
Priority MEDIUM 60
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08334 · Published 2020-10-22 · Partial fix
Priority MEDIUM 58
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06761 · Published 2021-05-06 · Fixed
Priority MEDIUM 54
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.pars…
CVSS 3.1MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.40736 · Published 2021-02-15 · Partial fix · 3.6.13, 3.7.10 +2 CWE-444
Priority MEDIUM 50
A flaw was found in Python, specifically within the urllib.parse module.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.08543 · Published 2022-02-09 · Partial fix CWE-74
Priority MEDIUM 49
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.06799 · Published 2021-02-07 · Partial fix · 3.3.2 CWE-190
Priority MEDIUM 43
There's a flaw in urllib's AbstractBasicAuthHandler class.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.04799 · Published 2022-03-07 · Partial fix CWE-400
Priority LOW 39
An issue was discovered in urllib3 before 1.26.5.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03273 · Published 2021-06-29 · Partial fix · 1.26.5 CWE-400
Priority LOW 36
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03409 · Published 2022-08-24 · Partial fix CWE-252
Priority LOW 35
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0077 · Published 2021-10-20 · Partial fix · 2.9.1 CWE-22
Priority LOW 34
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.04035 · Published 2021-03-21 · Partial fix · 4.6.3 CWE-79
Priority LOW 34
A XSS vulnerability was discovered in python-lxml's clean module.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03982 · Published 2020-12-03 · Partial fix · 4.6.2 CWE-79
Priority LOW 31
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02463 · Published 2021-01-11 · Partial fix · 3.2 CWE-385
Priority LOW 30
This affects the package jinja2 from 0.0.0 and before 2.11.3.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03589 · Published 2021-02-01 · Partial fix · 2.11.3 CWE-400
Priority LOW 29
A flaw was found in python-pip in the way it handled Unicode separators in git references.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.01829 · Published 2021-11-10 · Partial fix · 21.1 CWE-20
Priority LOW 29
There's a flaw in Python 3's pydoc.
CVSS 3.1MEDIUM 5.7· Adjacent network · Low privileges · No interaction · EPSS 0.01863 · Published 2021-05-20 · Partial fix CWE-200
THREATIST.IORead the docs