Red Hat Security AdvisoryRHSA-2021:4162
python38:3.8 and python38-devel:3.8 security update
Released 2021-11-09 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
Fixes 10 records
Priority MEDIUM 60
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08334 · Published 2020-10-22 · Partial fix
Priority MEDIUM 58
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06761 · Published 2021-05-06 · Fixed
Priority MEDIUM 54
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.pars…
CVSS 3.1MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.40736 · Published 2021-02-15 · Partial fix · 3.6.13, 3.7.10 +2 CWE-444
Priority LOW 39
An issue was discovered in urllib3 before 1.26.5.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03273 · Published 2021-06-29 · Partial fix · 1.26.5 CWE-400
Priority LOW 39
psutil (aka python-psutil) through 5.6.5 can have a double free.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03522 · Published 2019-11-12 · Partial fix · 5.6.6 CWE-415
Priority LOW 35
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0077 · Published 2021-10-20 · Partial fix · 2.9.1 CWE-22
Priority LOW 34
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.04035 · Published 2021-03-21 · Partial fix · 4.6.3 CWE-79
Priority LOW 30
This affects the package jinja2 from 0.0.0 and before 2.11.3.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03589 · Published 2021-02-01 · Partial fix · 2.11.3 CWE-400
Priority LOW 29
A flaw was found in python-pip in the way it handled Unicode separators in git references.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.01829 · Published 2021-11-10 · Partial fix · 21.1 CWE-20
Priority LOW 29
There's a flaw in Python 3's pydoc.
CVSS 3.1MEDIUM 5.7· Adjacent network · Low privileges · No interaction · EPSS 0.01863 · Published 2021-05-20 · Partial fix CWE-200
THREATIST.IORead the docs