Amazon Linux AMI : python27 (ALAS-2020-1375)

medium Nessus Plugin ID 137098

Language:

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

The version of python27 installed on the remote host is prior to 2.7.18-1.137. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1375 advisory.

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.(CVE-2018-20852)

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to theCVE-2019-9740query string issue and theCVE-2019-9947path string issue. (This is not exploitable when glibc hasCVE-2016-10739fixed.) A CRLF injection flaw was discovered in python in the way URLs are handled when doing an HTTP/HTTPS connection (e.g. through urlopen() or HTTPConnection).
An attacker who can control the url parameter passed to urlopen method in the urllib/urllib2 modules can inject CRLF sequences and HTTP headers by abusing the host part of the URL. (CVE-2019-18348)(Additional CVE details added after release.)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update python27' to update your system.

Plugin Details

Severity: Medium

ID: 137098

File Name: ala_ALAS-2020-1375.nasl

Version: 1.5

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 6/4/2020

Updated: 12/17/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2018-20852

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2019-18348

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:python27-libs, p-cpe:/a:amazon:linux:python27-devel, p-cpe:/a:amazon:linux:python27-test, p-cpe:/a:amazon:linux:python27, p-cpe:/a:amazon:linux:python27-debuginfo, p-cpe:/a:amazon:linux:python27-tools, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/3/2020

Vulnerability Publication Date: 7/13/2019

Reference Information

CVE: CVE-2018-20852, CVE-2019-18348

ALAS: 2020-1375

Detections

Analytics