Red Hat Security Advisory

RHSA-2021:4160

python39:3.9 and python39-devel:3.9 security update

Released 2021-11-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 8) Cython-0.29.21-5.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pybind11-2.6.1-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9 +33
Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47

TI-2021-10543 CVE-2021-29921 · GHSA-cxqv-r2cc-r9c9

MEDIUM 58

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06761 Published 2021-05-06 Fixed

TI-2021-02670 CVE-2021-3737 · GHSA-hr7v-m862-8hh8

MEDIUM 53

A flaw was found in python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13166 Published 2022-03-04 Partial fix CWE-835

TI-2021-02666 CVE-2021-3733 · GHSA-wj55-vqcq-gxcp

MEDIUM 43

There's a flaw in urllib's AbstractBasicAuthHandler class.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04799 Published 2022-03-07 Partial fix CWE-400

TI-2021-12905 CVE-2021-33503 · GHSA-q2q7-5pp4-w6pg

LOW 39

An issue was discovered in urllib3 before 1.26.5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03273 Published 2021-06-29 Partial fix · 1.26.5 CWE-400

TI-2021-09882 CVE-2021-28957 · GHSA-jq4v-f5q6-mjqq

LOW 34

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04035 Published 2021-03-21 Partial fix · 4.6.3 CWE-79

TI-2021-02521 CVE-2021-3572 · GHSA-5xp3-jfq3-5q8x

LOW 29

A flaw was found in python-pip in the way it handled Unicode separators in git references.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.01829 Published 2021-11-10 Partial fix · 21.1 CWE-20

TI-2021-02390 CVE-2021-3426 · GHSA-6qp6-q95v-x2qw

LOW 29

There's a flaw in Python 3's pydoc.

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.01863 Published 2021-05-20 Partial fix CWE-200