/[advisories]/25641.adv
ViewVC logotype

Diff of /25641.adv

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 9220 by tmb, Thu Nov 7 22:24:37 2019 UTC revision 9228 by tmb, Sun Nov 10 18:16:38 2019 UTC
# Line 1  Line 1 
1  type: security  type: security
2  subject: Updated python packages fix security vulnerabilities  subject: Updated python packages fix security vulnerabilities
3  CVE:  CVE:
4     - CVE-2019-9740
5     - CVE-2019-9947
6     - CVE-2019-9948
7     - CVE-2019-10160
8   - CVE-2019-16056   - CVE-2019-16056
9   - CVE-2019-16935   - CVE-2019-16935
10  src:  src:
# Line 10  src: Line 14  src:
14       - python3-3.7.5-1.mga7       - python3-3.7.5-1.mga7
15  description: |  description: |
16    Updated python and python3 packages fix security vulnerabilities:    Updated python and python3 packages fix security vulnerabilities:
17    
18      An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
19      in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
20      controls a url parameter, as demonstrated by the first argument to
21      urllib.request.urlopen with \r\n followed by an HTTP header or a Redis
22      command (CVE-2019-9740).
23    
24      An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
25      in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
26      controls a url parameter, as demonstrated by the first argument to
27      urllib.request.urlopen with \r\n (specifically in the path component of a
28      URL) followed by an HTTP header or a Redis command. This is similar to
29      CVE-2019-9740 query string issue (CVE-2019-9947).
30    
31      urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which
32      makes it easier for remote attackers to bypass protection mechanisms that
33      blacklist file: URIs, as demonstrated by triggering a
34      urllib.urlopen('local_file:///etc/passwd') call (CVE-2019-9948).
35    
36      A security regression of CVE-2019-9636 was discovered in python, which
37      still allows an attacker to exploit CVE-2019-9636 by abusing the user and
38      password parts of a URL. When an application parses user-supplied URLs to
39      store cookies, authentication credentials, or other kind of information,
40      it is possible for an attacker to provide specially crafted URLs to make
41      the application locate host-related information (e.g. cookies,
42      authentication data) and send them to a different host than where it
43      should, unlike if the URLs had been correctly parsed. The result of an
44      attack may vary based on the application (CVE-2019-10160).
45    
46    It was discovered that Python incorrectly parsed certain email addresses.    It was discovered that Python incorrectly parsed certain email addresses.
47    A remote attacker could possibly use this issue to trick Python    A remote attacker could possibly use this issue to trick Python
48    applications into accepting email addresses that should be denied    applications into accepting email addresses that should be denied
# Line 20  description: | Line 53  description: |
53    a cross-site scripting (XSS) attack (CVE-2019-16935).    a cross-site scripting (XSS) attack (CVE-2019-16935).
54  references:  references:
55   - https://bugs.mageia.org/show_bug.cgi?id=25641   - https://bugs.mageia.org/show_bug.cgi?id=25641
56     - https://access.redhat.com/errata/RHSA-2019:1587
57     - https://access.redhat.com/errata/RHSA-2019:2030
58     - https://access.redhat.com/errata/RHSA-2019:3520
59   - https://usn.ubuntu.com/4151-1/   - https://usn.ubuntu.com/4151-1/
60  ID: MGASA-2019-0318  ID: MGASA-2019-0318

Legend:
Removed from v.9220  
changed lines
  Added in v.9228

  ViewVC Help
Powered by ViewVC 1.1.26