An update for python is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es) :

* python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)

* python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)

* python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

* python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

* python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms (CVE-2019-9948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3520 advisory.

  - python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)

  - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

  - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

  - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1462 advisory.

  - python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)

  - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

  - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

  - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-26 (Python: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Python. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly perform a CRLF injection attack, obtain       sensitive information, trick Python into sending cookies to the wrong       domain or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2030 advisory.

  - python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)

  - python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)

  - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

  - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

  - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python fixes the following issues :

Security issues fixed :

  - CVE-2019-9947: Fixed an insufficient validation of URL     paths with embedded whitespace or control characters     that could allow HTTP header injections. (bsc#1130840)

  - CVE-2019-16056: Fixed a parser issue in the email     module. (bsc#1149955)

  - CVE-2019-16935: Fixed a reflected XSS in     python/Lib/DocXMLRPCServer.py (bsc#1153238).

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in urllib2 in Python 2.x     through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the first argument to     urllib.request.urlopen with \r\n (specifically in the     query string after a ? character) followed by an HTTP     header or a Redis command.(CVE-2019-9740)

  - An issue was discovered in urllib2 in Python 2.x     through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a     url parameter, as demonstrated by the first argument to     urllib.request.urlopen with \r\n (specifically in the     path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is     similar to the CVE-2019-9740 query string     issue.(CVE-2019-9947)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An issue was discovered in urllib2 in Python 2.x and urllib in Python 3.x. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. (CVE-2019-9947 , CVE-2019-9740)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3335 advisory.

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an     HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10,     v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12,     v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1,     v3.7.8, v3.7.8rc1, v3.7.9. (CVE-2019-9740)

  - An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3.
    CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument     to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character)     followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
    This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1,     v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4,     v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.
    (CVE-2019-9947)

  - urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd') call. (CVE-2019-9948)

  - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the     request parameter. (CVE-2019-11236)

  - ** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module     unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as     demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that     might have legitimate applications in (for example) loading serialized Python object arrays from trusted     and authenticated sources. (CVE-2019-6446)

  - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA     certificates is different from the OS store of CA certificates, which results in SSL connections     succeeding in situations where a verification failure is the correct outcome. This is related to use of     the ssl_context, ca_certs, or ca_certs_dir argument. (CVE-2019-11324)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3725 advisory.

  - python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib (CVE-2018-1060)

  - python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib (CVE-2018-1061)

  - python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)

  - python: Integer overflow in Modules/_pickle.c allows for memory exhaustion if serializing gigabytes of     data (CVE-2018-20406)

  - python: Cookie domain check returns incorrect results (CVE-2018-20852)

  - python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)

  - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

  - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

  - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

  - python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

ID	Name	Product	Family	Published	Updated	Severity
128333	CentOS 7 : python (CESA-2019:2030)	Nessus	CentOS Local Security Checks	8/30/2019	4/30/2024	critical
130548	RHEL 8 : python3 (RHSA-2019:3520)	Nessus	Red Hat Local Security Checks	11/6/2019	4/27/2024	critical
135459	RHEL 7 : python (RHSA-2020:1462)	Nessus	Red Hat Local Security Checks	4/14/2020	4/28/2024	critical
134603	GLSA-202003-26 : Python: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	3/16/2020	3/22/2024	critical
127651	RHEL 7 : python (RHSA-2019:2030)	Nessus	Red Hat Local Security Checks	8/12/2019	5/7/2024	critical
130337	openSUSE Security Update : python (openSUSE-2019-2389)	Nessus	SuSE Local Security Checks	10/28/2019	4/16/2024	high
126285	EulerOS 2.0 SP8 : python3 (EulerOS-SA-2019-1658)	Nessus	Huawei Local Security Checks	6/27/2019	5/14/2024	medium
126959	Amazon Linux 2 : python3 (ALAS-2019-1247)	Nessus	Amazon Linux Local Security Checks	7/24/2019	5/8/2024	medium
180874	Oracle Linux 8 : python27:2.7 (ELSA-2019-3335)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/7/2023	critical
194161	RHEL 6 / 7 : rh-python36-python (RHSA-2019:3725)	Nessus	Red Hat Local Security Checks	4/28/2024	4/28/2024	critical
202777	Photon OS 3.0: Python3 PHSA-2019-3.0-0016	Nessus	PhotonOS Local Security Checks	7/22/2024	7/24/2024	medium

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

high

medium

medium

critical

critical

medium