Red Hat Security Advisory

RHSA-2022:5235

python security update

Released 2022-06-28 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) python-2.7.5-92.el7_9, python-libs-2.7.5-92.el7_9
Red Hat Enterprise Linux Client Optional (v. 7) python-debug-2.7.5-92.el7_9, python-devel-2.7.5-92.el7_9, python-test-2.7.5-92.el7_9 +2
Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-debug-2.7.5-92.el7_9, python-test-2.7.5-92.el7_9, python-tools-2.7.5-92.el7_9 +1
Red Hat Enterprise Linux Server (v. 7) python-2.7.5-92.el7_9, python-devel-2.7.5-92.el7_9, python-libs-2.7.5-92.el7_9 +1
Red Hat Enterprise Linux Server Optional (v. 7) python-debug-2.7.5-92.el7_9, python-test-2.7.5-92.el7_9, python-tools-2.7.5-92.el7_9 +1
Red Hat Enterprise Linux Workstation (v. 7) python-2.7.5-92.el7_9, python-devel-2.7.5-92.el7_9, python-libs-2.7.5-92.el7_9
Red Hat Enterprise Linux Workstation Optional (v. 7) python-debug-2.7.5-92.el7_9, python-test-2.7.5-92.el7_9, python-tools-2.7.5-92.el7_9 +1

Fixes 3 records

TI-2021-02254 CVE-2021-3177 · GHSA-hc96-xw56-vfwh

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c…

HIGH 82

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demons…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.24002 Published 2021-01-19 Partial fix CWE-120

TI-2020-15959 CVE-2020-26116 · GHSA-w7gf-rpqw-gx4f

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and…

MEDIUM 47

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF cont…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.06358 Published 2020-09-27 Partial fix CWE-74

TI-2020-15974 CVE-2020-26137 · GHSA-wqvq-5m8c-6g24

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request…

LOW 33

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest().

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02269 Published 2020-09-29 Partial fix · 1.25.9 CWE-74