Updated python packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Python is an interpreted, interactive, object-oriented programming language often compared to Tcl, Perl, Scheme, or Java. Python includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems (X11, Motif, Tk, Mac and MFC).

It was discovered that the Python xmlrpclib module did not restrict the size of gzip-compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict the sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory. (CVE-2013-1752)

It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose the source code of the scripts in the cgi-bin directory. (CVE-2014-4650)

An integer overflow flaw was found in the way the buffer() function handled its offset and size arguments. An attacker able to control these arguments could use this flaw to disclose portions of the application memory or cause it to crash. (CVE-2014-7185)

A flaw was found in the way the json module handled negative index arguments passed to certain functions (such as raw_decode()). An attacker able to control the index value passed to one of the affected functions could possibly use this flaw to disclose portions of the application memory. (CVE-2014-4616)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

Note: The Python standard library was updated to make it possible to enable certificate verification by default. However, for backwards compatibility, verification remains disabled by default. Future updates may change this default. Refer to the Knowledgebase article 2039753 linked to in the References section for further details about this change. (BZ#1219108)

This update also fixes the following bugs :

* Subprocesses used with the Eventlet library or regular threads previously tried to close epoll file descriptors twice, which led to an 'Invalid argument' error. Subprocesses have been fixed to close the file descriptors only once. (BZ#1103452)

* When importing the readline module from a Python script, Python no longer produces erroneous random characters on stdout. (BZ#1189301)

* The cProfile utility has been fixed to print all values that the '-s' option supports when this option is used without a correct value.
(BZ#1237107)

* The load_cert_chain() function now accepts 'None' as a keyfile argument. (BZ#1250611)

In addition, this update adds the following enhancements :

* Security enhancements as described in PEP 466 have been backported to the Python standard library, for example, new features of the ssl module: Server Name Indication (SNI) support, support for new TLSv1.x protocols, new hash algorithms in the hashlib module, and many more.
(BZ#1111461)

* Support for the ssl.PROTOCOL_TLSv1_2 protocol has been added to the ssl library. (BZ#1192015)

* The ssl.SSLSocket.version() method is now available to access information about the version of the SSL protocol used in a connection. (BZ#1259421)

All python users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

This update for python3 fixes the following issues :

  - apply fix for CVE-2016-1000110 - CGIHandler: sets     environmental variable based on user-supplied Proxy     request header (fixes boo#989523, CVE-2016-1000110)

  - update to 3.4.5 check:
    https://docs.python.org/3.4/whatsnew/changelog.html     (fixes boo#984751, CVE-2016-0772) (fixes boo#985177,     CVE-2016-5636) (fixes boo#985348, CVE-2016-5699)

  - Bump DH parameters to 2048 bit to fix logjam security     issue. boo#935856

  - apply fix for CVE-2016-1000110 - CGIHandler: sets     environmental variable based on user-supplied Proxy     request header: (fixes boo#989523, CVE-2016-1000110)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1064 advisory.

    - Add httplib fix for CVE-2013-1752     Resolves: rhbz#1187779
    - Fixed CVE-2013-1752, CVE-2013-1753     Resolves: rhbz#1187779

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This python3 update fixes the following security and non security issues :

  - CGIHTTPServer file disclosure and directory traversal     through URL-encoded characters (CVE-2014-4650,     bnc#885882)

  - fix import_failed hook file names

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2653-1 advisory.

    It was discovered that multiple Python protocol libraries incorrectly limited certain data when connecting     to servers. A malicious ftp, http, imap, nntp, pop or smtp server could use this issue to cause a denial     of service. (CVE-2013-1752)

    It was discovered that the Python xmlrpc library did not limit unpacking gzip-compressed HTTP bodies. A     malicious server could use this issue to cause a denial of service. (CVE-2013-1753)

    It was discovered that the Python json module incorrectly handled a certain argument. An attacker could     possibly use this issue to read arbitrary memory and expose sensitive information. This issue only     affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-4616)

    It was discovered that the Python CGIHTTPServer incorrectly handled URL-encoded path separators in URLs. A     remote attacker could use this issue to expose sensitive information, or possibly execute arbitrary code.
    This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-4650)

    It was discovered that Python incorrectly handled sizes and offsets in buffer functions. An attacker could     possibly use this issue to read arbitrary memory and obtain sensitive information. This issue only     affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-7185)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to python 2.7.9 fixes the following issues :

  - python-2.7-libffi-aarch64.patch: Fix argument passing in     libffi for aarch64

From the version update to 2.7.9 :

  - contains full backport of ssl module from Python 3.4     (PEP466)

  - HTTPS certificate validation enabled by default (PEP476)

  - SSLv3 disabled by default (bnc#901715)

  - backported ensurepip module (PEP477)

  - fixes several missing CVEs from last release:
    CVE-2013-1752, CVE-2013-1753

  - dropped upstreamed patches: python-2.7.6-poplib.patch,     smtplib_maxline-2.7.patch, xmlrpc_gzip_27.patch

  - dropped patch python-2.7.3-ssl_ca_path.patch because we     don't need it with ssl module from Python 3

  - libffi was upgraded upstream, seems to contain our     changes, so dropping libffi-ppc64le.diff as well

  - python-2.7-urllib2-localnet-ssl.patch - properly remove     unconditional 'import ssl' from test_urllib2_localnet     that caused it to fail without ssl

  - skip test_thread in qemu_linux_user mode

From the version update to 2.7.8 :

  - fixes CVE-2014-4650 directory traversal in CGIHTTPServer

  - fixes CVE-2014-7185 (bnc#898572) potential buffer     overflow in buffer()

Also the DH parameters were increased to 2048 bit to fix logjam security issue (bsc#935856)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2015:2101-1 advisory.

  - The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to     cause a denial of service (memory consumption) via a crafted HTTP request. (CVE-2013-1753)

  - Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson     before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index     value in the idx argument to the raw_decode function. (CVE-2014-4616)

  - The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is     used for path separators, which allows remote attackers to read script source code or conduct directory     traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f     separator. (CVE-2014-4650)

  - Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain     sensitive information from process memory via a large size and offset in a buffer function.
    (CVE-2014-7185)

  - The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka     Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the     certificate against a trust store or verify that the server hostname matches a domain name in the     subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-     middle attackers to spoof SSL servers via an arbitrary valid certificate. (CVE-2014-9365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python fixes the following issues :

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1064 advisory.

    Python is an interpreted, interactive, object-oriented programming language     that supports modules, classes, exceptions, high-level dynamic data types,     and dynamic typing. The python27 collection provide a stable release of     Python 2.7 with a number of additional utilities and database connectors     for MySQL and PostgreSQL.

    The python27-python packages have been upgraded to upstream version 2.7.8,     which provides numerous bug fixes over the previous version. (BZ#1167912)

    The following security issues were fixed in the python27-python component:

    It was discovered that the socket.recvfrom_into() function failed to check     the size of the supplied buffer. This could lead to a buffer overflow when     the function was called with an insufficiently sized buffer.
    (CVE-2014-1912)

    It was discovered that the Python xmlrpclib module did not restrict the     size of gzip-compressed HTTP responses. A malicious XMLRPC server could     cause an XMLRPC client using xmlrpclib to consume an excessive amount of     memory. (CVE-2013-1753)

    It was discovered that multiple Python standard library modules     implementing network protocols (such as httplib or smtplib) failed to     restrict the sizes of server responses. A malicious server could cause a     client using one of the affected modules to consume an excessive amount of     memory. (CVE-2013-1752)

    It was discovered that the CGIHTTPServer module incorrectly handled URL     encoded paths. A remote attacker could use this flaw to execute scripts     outside of the cgi-bin directory, or disclose the source code of the     scripts in the cgi-bin directory. (CVE-2014-4650)

    An integer overflow flaw was found in the way the buffer() function handled     its offset and size arguments. An attacker able to control these arguments     could use this flaw to disclose portions of the application memory or cause     it to crash. (CVE-2014-7185)

    The following security issue was fixed in the python27-python and     python27-python-simplejson components:

    A flaw was found in the way the json module handled negative index     arguments passed to certain functions (such as raw_decode()). An attacker     able to control the index value passed to one of the affected functions     could possibly use this flaw to disclose portions of the application     memory. (CVE-2014-4616)

    In addition, this update adds the following enhancement:

    * The python27 Software Collection now includes the python-wheel and     python-pip modules. (BZ#994189, BZ#1167902)

    All python27 users are advised to upgrade to these updated packages, which     correct these issues and add these enhancements. All running python27     instances must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-803:01 advisory.

    IPy is a Python module for handling IPv4 and IPv6 Addresses and Networks     in a fashion similar to perl's Net::IP and friends. The IP class allows     a comfortable parsing and handling for most notations in use for IPv4     and IPv6 Addresses and Networks.
    Security issues fixed with this release:
    CVE-2013-1752
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2013-1753
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2014-4616
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2014-4650
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2014-7185     Integer overflow in bufferobject.c in Python before 2.7.8 allows     context-dependent attackers to obtain sensitive information from     process memory via a large size and offset in a buffer function.
    Fixed bugs:
    * Subprocesses used with the Eventlet library or regular threads previously tried to close epoll file     descriptors twice, which led to an Invalid argument error. Subprocesses have been fixed to close the     file descriptors only once.
    * When importing the readline module from a Python script, Python no longer produces erroneous random     characters on stdout.
    * The cProfile utility has been fixed to print all values that the -s option supports when this option     is used without a correct value.
    * The load_cert_chain() function now accepts None as a keyfile argument.
    Enhancements:
    * Security enhancements as described in PEP 466 have been backported to the Python standard library, for     example, new features of the ssl module: Server Name Indication (SNI) support, support for new TLSv1.x     protocols, new hash algorithms in the hashlib module, and many more.
    * Support for the ssl.PROTOCOL_TLSv1_2 protocol has been added to the ssl library.
    * The ssl.SSLSocket.version() method is now available to access information about the version of the SSL     protocol used in a connection.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fix for CVE-2014-4650: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An integer overflow flaw was found in the way the buffer() function handled its offset and size arguments. An attacker able to control those arguments could use this flaw to disclose portions of the application memory or cause it to crash.

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory.

It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose source of scripts in the cgi-bin directory.

This update for python3 to version 3.6.10 fixes the following issues :

CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).

CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).

CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 to version 3.6.10 fixes the following issues :

  - CVE-2017-18207: Fixed a denial of service in     Wave_read._read_fmt_chunk() (bsc#1083507).

  - CVE-2019-16056: Fixed an issue where email parsing could     fail for multiple @ (bsc#1149955).

  - CVE-2019-15903: Fixed a heap-based buffer over-read in     libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
87129	CentOS 7 : python (CESA-2015:2101)	Nessus	CentOS Local Security Checks	2015/12/2	2021/1/4	critical
93069	openSUSE Security Update : python3 (openSUSE-2016-997) (httpoxy)	Nessus	SuSE Local Security Checks	2016/8/22	2026/1/28	critical
181042	Oracle Linux 6 / 7 : python27 (ELSA-2015-1064)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2025/9/1	critical
77295	openSUSE Security Update : python3 (openSUSE-SU-2014:1042-1)	Nessus	SuSE Local Security Checks	2014/8/21	2021/1/19	critical
84428	Ubuntu 14.04 LTS : Python vulnerabilities (USN-2653-1)	Nessus	Ubuntu Local Security Checks	2015/6/26	2025/8/29	critical
85250	SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2015:1344-1)	Nessus	SuSE Local Security Checks	2015/8/6	2021/1/6	critical
87570	Scientific Linux Security Update : python on 7.x i686/x86_64 (2015:2101)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2025/8/29	critical
133259	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	2020/1/27	2024/3/28	critical
210167	RHEL 6 / 7 : python27 (RHSA-2015:1064)	Nessus	Red Hat Local Security Checks	2024/11/4	2025/9/1	critical
289468	MiracleLinux 7 : python-2.7.5-34.0.1.el7.AXS7 (AXSA:2015-803:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
79075	Fedora 20 : python-2.7.5-15.fc20 (2014-14227)	Nessus	Fedora Local Security Checks	2014/11/10	2021/1/11	medium
87347	Amazon Linux AMI : python26 (ALAS-2015-621)	Nessus	Amazon Linux Local Security Checks	2015/12/15	2020/2/27	critical
133036	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	2020/1/17	2024/3/29	critical
133172	openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	2020/1/22	2024/3/29	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical