Python 2.7.17 is a bug fix release in the Python 2.7.x series. It is expected to be the penultimate release for Python 2.7.

https://www.python.org/downloads/release/python-2717/

  - Security fix for CVE-2018-20852.

  - Security fix for CVE-2019-16056.

  - Security fix for CVE-2019-16935.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 to 3.6.9 fixes the following issues :

Security issues fixed :

  - CVE-2019-16056: Fixed a parser issue in the email     module. (bsc#1149955)

  - CVE-2019-16935: Fixed a reflected XSS in     python/Lib/DocXMLRPCServer.py (bsc#1153238).

Non-security issues fixed :

  - Fixed regression of OpenSSL 1.1.1b-1 in EVP_PBE_scrypt()     with salt=NULL. (bsc#1151490)

  - Improved locale handling by implementing PEP 538.

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues :

Security issue fixed :

CVE-2019-16056: Fixed a parser issue in the email module (bsc#1149955).

CVE-2019-16935: Fixed a reflected XSS in python/Lib/DocXMLRPCServer.py (bsc#1153238).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the python2 package has been released.

An update of the python3 package has been released.

This update for python3 fixes the following issues :

  - Fixed CVE-2020-27619 (bsc#1178009), where     Lib/test/multibytecodec_support calls eval() on content     retrieved via HTTP.

  - Change setuptools and pip version numbers according to     new wheels

  - Handful of changes to make python36 compatible with     SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738)

  - add triplets for mips-r6 and riscv

  - RISC-V needs CTYPES_PASS_BY_REF_HACK

Update to 3.6.12 (bsc#1179193)

  - Ensure python3.dll is loaded from correct locations when     Python is embedded

  - The __hash__() methods of ipaddress.IPv4Interface and     ipaddress.IPv6Interface incorrectly generated constant     hash values of 32 and 128 respectively. This resulted in     always causing hash collisions. The fix uses hash() to     generate hash values for the tuple of (address, mask     length, network address).

  - Prevent http header injection by rejecting control     characters in http.client.putrequest(&hellip;).

  - Unpickling invalid NEWOBJ_EX opcode with the C     implementation raises now UnpicklingError instead of     crashing.

  - Avoid infinite loop when reading specially crafted TAR     files using the tarfile module

  - This release also fixes CVE-2020-26116 (bsc#1177211) and     CVE-2019-20907 (bsc#1174091).

Update to 3.6.11 :

  - Disallow CR or LF in email.headerregistry. Address     arguments to guard against header injection attacks.

  - Disallow control characters in hostnames in http.client,     addressing CVE-2019-18348. Such potentially malicious     header injection URLs now cause a InvalidURL to be     raised. (bsc#1155094)

  - CVE-2020-8492: The AbstractBasicAuthHandler class of the     urllib.request module uses an inefficient regular     expression which can be exploited by an attacker to     cause a denial of service. Fix the regex to prevent the     catastrophic backtracking. Vulnerability reported by Ben     Caller and Matt Schwager.

This update was imported from the SUSE:SLE-15:Update update project.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4433 advisory.

  - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary     JavaScript can be delivered to clients that visit the http URL for this server. (CVE-2019-16935)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
    (CVE-2020-14422)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
130789	Fedora 30 : python2 / python2-docs (2019-74ba24605e)	Nessus	Fedora Local Security Checks	2019/11/12	2024/4/12	high
130790	Fedora 29 : python2 / python2-docs (2019-758824a3ff)	Nessus	Fedora Local Security Checks	2019/11/12	2024/4/12	high
130886	openSUSE Security Update : python3 (openSUSE-2019-2453)	Nessus	SuSE Local Security Checks	2019/11/12	2024/4/12	high
130943	SUSE SLES12 Security Update : python (SUSE-SU-2019:2748-2)	Nessus	SuSE Local Security Checks	2019/11/13	2024/4/11	high
130114	Photon OS 2.0: Python2 PHSA-2019-2.0-0182	Nessus	PhotonOS Local Security Checks	2019/10/22	2024/4/17	medium
130115	Photon OS 2.0: Python3 PHSA-2019-2.0-0182	Nessus	PhotonOS Local Security Checks	2019/10/22	2024/4/17	medium
145326	openSUSE Security Update : python3 (openSUSE-2020-2332)	Nessus	SuSE Local Security Checks	2021/1/25	2024/1/26	critical
157686	AlmaLinux 8 : python3 (ALSA-2020:4433)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	medium

偵測

搜尋 Plugin

high

high

high

high

medium

medium

critical

medium