This update for python, python-base fixes the following issues :

Security issues fixed :

CVE-2018-1000802: Prevent command injection in shutil module (make_archive function) via passage of unfiltered user input (bsc#1109663).

CVE-2018-1061: Fixed DoS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib (bsc#1088004).

CVE-2018-1060: Fixed DoS via regular expression catastrophic backtracking in apop() method in pop3lib (bsc#1088009).

Bug fixes: bsc#1086001: python tarfile uses random order.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-1000802

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

  - ** DISPUTED ** The Wave_read._read_fmt_chunk function     in Lib/wave.py in Python through 3.6.4 does not ensure     a nonzero channel value, which allows attackers to     cause a denial of service (divide-by-zero and     exception) via a crafted wav format audio file. NOTE:
    the vendor disputes this issue because Python     applications 'need to be prepared to handle a wide     variety of exceptions.'(CVE-2017-18207)

  - Python Software Foundation Python (CPython) version 2.7     contains a CWE-77: Improper Neutralization of Special     Elements used in a Command ('Command Injection')     vulnerability in shutil module (make_archive function)     that can result in Denial of service, Information gain     via injection of arbitrary files on the system or     entire drive. This attack appear to be exploitable via     Passage of unfiltered user input to the function. This     vulnerability appears to have been fixed in after     commit     add531a1e55b0a739b0f42582f1c9747e5649ace.(CVE-2018-1000     802)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
118501	SUSE SLED12 / SLES12 Security Update : python, python-base (SUSE-SU-2018:3554-1)	Nessus	SuSE Local Security Checks	2018/10/30	2024/7/26	critical
119571	SUSE SLED12 / SLES12 Security Update : python, python-base (SUSE-SU-2018:3554-2)	Nessus	SuSE Local Security Checks	2018/12/11	2024/7/16	critical
117843	Fedora 27 : python2 (2018-c3a5b2029a)	Nessus	Fedora Local Security Checks	2018/10/1	2024/8/1	critical
137488	EulerOS 2.0 SP2 : python (EulerOS-SA-2020-1646)	Nessus	Huawei Local Security Checks	2020/6/17	2024/3/6	critical
133259	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	2020/1/27	2024/3/28	critical

检测

插件搜索

critical

critical

critical

critical

critical