advisories/25641.adv

type: security
subject: Updated python packages fix security vulnerabilities
CVE:
 - CVE-2019-9740
 - CVE-2019-9947
 - CVE-2019-9948
 - CVE-2019-10160
 - CVE-2019-16056
 - CVE-2019-16935
src:
  7:
   core:
     - python-2.7.17-1.1.mga7
     - python3-3.7.5-1.mga7
description: |
  Updated python and python3 packages fix security vulnerabilities:

  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
  in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
  controls a url parameter, as demonstrated by the first argument to
  urllib.request.urlopen with \r\n followed by an HTTP header or a Redis
  command (CVE-2019-9740).

  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
  in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
  controls a url parameter, as demonstrated by the first argument to
  urllib.request.urlopen with \r\n (specifically in the path component of a
  URL) followed by an HTTP header or a Redis command. This is similar to
  CVE-2019-9740 query string issue (CVE-2019-9947).

  urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which
  makes it easier for remote attackers to bypass protection mechanisms that
  blacklist file: URIs, as demonstrated by triggering a 
  urllib.urlopen('local_file:///etc/passwd') call (CVE-2019-9948).

  A security regression of CVE-2019-9636 was discovered in python, which
  still allows an attacker to exploit CVE-2019-9636 by abusing the user and
  password parts of a URL. When an application parses user-supplied URLs to
  store cookies, authentication credentials, or other kind of information,
  it is possible for an attacker to provide specially crafted URLs to make
  the application locate host-related information (e.g. cookies,
  authentication data) and send them to a different host than where it
  should, unlike if the URLs had been correctly parsed. The result of an
  attack may vary based on the application (CVE-2019-10160).

  It was discovered that Python incorrectly parsed certain email addresses.
  A remote attacker could possibly use this issue to trick Python
  applications into accepting email addresses that should be denied
  (CVE-2019-16056).

  It was discovered that the Python documentation XML-RPC server incorrectly
  handled certain fields. A remote attacker could use this issue to execute
  a cross-site scripting (XSS) attack (CVE-2019-16935).
references:
 - https://bugs.mageia.org/show_bug.cgi?id=25641
 - https://access.redhat.com/errata/RHSA-2019:1587
 - https://access.redhat.com/errata/RHSA-2019:2030
 - https://access.redhat.com/errata/RHSA-2019:3520
 - https://usn.ubuntu.com/4151-1/
ID: MGASA-2019-0318
1	type: security
2	subject: Updated python packages fix security vulnerabilities
3	CVE:
4	- CVE-2019-9740
5	- CVE-2019-9947
6	- CVE-2019-9948
7	- CVE-2019-10160
8	- CVE-2019-16056
9	- CVE-2019-16935
10	src:
11	7:
12	core:
13	- python-2.7.17-1.1.mga7
14	- python3-3.7.5-1.mga7
15	description: \|
16	Updated python and python3 packages fix security vulnerabilities:
17
18	An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
19	in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
20	controls a url parameter, as demonstrated by the first argument to
21	urllib.request.urlopen with \r\n followed by an HTTP header or a Redis
22	command (CVE-2019-9740).
23
24	An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
25	in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
26	controls a url parameter, as demonstrated by the first argument to
27	urllib.request.urlopen with \r\n (specifically in the path component of a
28	URL) followed by an HTTP header or a Redis command. This is similar to
29	CVE-2019-9740 query string issue (CVE-2019-9947).
30
31	urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which
32	makes it easier for remote attackers to bypass protection mechanisms that
33	blacklist file: URIs, as demonstrated by triggering a
34	urllib.urlopen('local_file:///etc/passwd') call (CVE-2019-9948).
35
36	A security regression of CVE-2019-9636 was discovered in python, which
37	still allows an attacker to exploit CVE-2019-9636 by abusing the user and
38	password parts of a URL. When an application parses user-supplied URLs to
39	store cookies, authentication credentials, or other kind of information,
40	it is possible for an attacker to provide specially crafted URLs to make
41	the application locate host-related information (e.g. cookies,
42	authentication data) and send them to a different host than where it
43	should, unlike if the URLs had been correctly parsed. The result of an
44	attack may vary based on the application (CVE-2019-10160).
45
46	It was discovered that Python incorrectly parsed certain email addresses.
47	A remote attacker could possibly use this issue to trick Python
48	applications into accepting email addresses that should be denied
49	(CVE-2019-16056).
50
51	It was discovered that the Python documentation XML-RPC server incorrectly
52	handled certain fields. A remote attacker could use this issue to execute
53	a cross-site scripting (XSS) attack (CVE-2019-16935).
54	references:
55	- https://bugs.mageia.org/show_bug.cgi?id=25641
56	- https://access.redhat.com/errata/RHSA-2019:1587
57	- https://access.redhat.com/errata/RHSA-2019:2030
58	- https://access.redhat.com/errata/RHSA-2019:3520
59	- https://usn.ubuntu.com/4151-1/
60	ID: MGASA-2019-0318