1 |
type: security |
2 |
subject: Updated python packages fix security vulnerabilities |
3 |
CVE: |
4 |
- CVE-2019-9740 |
5 |
- CVE-2019-9947 |
6 |
- CVE-2019-9948 |
7 |
- CVE-2019-10160 |
8 |
- CVE-2019-16056 |
9 |
- CVE-2019-16935 |
10 |
src: |
11 |
7: |
12 |
core: |
13 |
- python-2.7.17-1.1.mga7 |
14 |
- python3-3.7.5-1.mga7 |
15 |
description: | |
16 |
Updated python and python3 packages fix security vulnerabilities: |
17 |
|
18 |
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib |
19 |
in Python 3.x through 3.7.2. CRLF injection is possible if the attacker |
20 |
controls a url parameter, as demonstrated by the first argument to |
21 |
urllib.request.urlopen with \r\n followed by an HTTP header or a Redis |
22 |
command (CVE-2019-9740). |
23 |
|
24 |
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib |
25 |
in Python 3.x through 3.7.2. CRLF injection is possible if the attacker |
26 |
controls a url parameter, as demonstrated by the first argument to |
27 |
urllib.request.urlopen with \r\n (specifically in the path component of a |
28 |
URL) followed by an HTTP header or a Redis command. This is similar to |
29 |
CVE-2019-9740 query string issue (CVE-2019-9947). |
30 |
|
31 |
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which |
32 |
makes it easier for remote attackers to bypass protection mechanisms that |
33 |
blacklist file: URIs, as demonstrated by triggering a |
34 |
urllib.urlopen('local_file:///etc/passwd') call (CVE-2019-9948). |
35 |
|
36 |
A security regression of CVE-2019-9636 was discovered in python, which |
37 |
still allows an attacker to exploit CVE-2019-9636 by abusing the user and |
38 |
password parts of a URL. When an application parses user-supplied URLs to |
39 |
store cookies, authentication credentials, or other kind of information, |
40 |
it is possible for an attacker to provide specially crafted URLs to make |
41 |
the application locate host-related information (e.g. cookies, |
42 |
authentication data) and send them to a different host than where it |
43 |
should, unlike if the URLs had been correctly parsed. The result of an |
44 |
attack may vary based on the application (CVE-2019-10160). |
45 |
|
46 |
It was discovered that Python incorrectly parsed certain email addresses. |
47 |
A remote attacker could possibly use this issue to trick Python |
48 |
applications into accepting email addresses that should be denied |
49 |
(CVE-2019-16056). |
50 |
|
51 |
It was discovered that the Python documentation XML-RPC server incorrectly |
52 |
handled certain fields. A remote attacker could use this issue to execute |
53 |
a cross-site scripting (XSS) attack (CVE-2019-16935). |
54 |
references: |
55 |
- https://bugs.mageia.org/show_bug.cgi?id=25641 |
56 |
- https://access.redhat.com/errata/RHSA-2019:1587 |
57 |
- https://access.redhat.com/errata/RHSA-2019:2030 |
58 |
- https://access.redhat.com/errata/RHSA-2019:3520 |
59 |
- https://usn.ubuntu.com/4151-1/ |
60 |
ID: MGASA-2019-0318 |