An update for python is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es) :

* It was discovered that the Python CGIHandler class did not properly protect against the HTTP_PROXY variable name clash in a CGI context. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a Python CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-1000110)

* It was found that Python's smtplib library did not return an exception when StartTLS failed to be established in the SMTP.starttls() function. A man in the middle attacker could strip out the STARTTLS command without generating an exception on the Python SMTP client application, preventing the establishment of the TLS layer. (CVE-2016-0772)

* It was found that the Python's httplib library (used by urllib, urllib2 and others) did not properly check HTTPConnection.putheader() function arguments. An attacker could use this flaw to inject additional headers in a Python application that allowed user provided header names or values. (CVE-2016-5699)

Red Hat would like to thank Scott Geary (VendHQ) for reporting CVE-2016-1000110.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the Python CGIHandler class did     not properly protect against the HTTP_PROXY variable     name clash in a CGI context. A remote attacker could     possibly use this flaw to redirect HTTP requests     performed by a Python CGI script to an     attacker-controlled proxy via a malicious HTTP request.
    (CVE-2016-1000110)

  - It was found that Python's smtplib library did not     return an exception when StartTLS failed to be     established in the SMTP.starttls() function. A man in     the middle attacker could strip out the STARTTLS     command without generating an exception on the Python     SMTP client application, preventing the establishment     of the TLS layer. (CVE-2016-0772)

  - It was found that the Python's httplib library (used by     urllib, urllib2 and others) did not properly check     HTTPConnection.putheader() function arguments. An     attacker could use this flaw to inject additional     headers in a Python application that allowed user     provided header names or values. (CVE-2016-5699)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

Updated to version 2.7.17 to unify packages among openSUSE:Factory and SLE versions (bsc#1159035).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that Python's smtplib library did not     return an exception when StartTLS failed to be     established in the SMTP.starttls() function. A man in     the middle attacker could strip out the STARTTLS     command without generating an exception on the Python     SMTP client application, preventing the establishment     of the TLS layer.(CVE-2016-0772)

  - A vulnerability was discovered in Python, in the     built-in zipimporter. A specially crafted zip file     placed in a module path such that it would be loaded by     a later 'import' statement could cause a heap overflow,     leading to arbitrary code execution.(CVE-2016-5636)

  - A flaw was found in the way the DES/3DES cipher was     used as part of the TLS/SSL protocol. A     man-in-the-middle attacker could use this flaw to     recover some plaintext data by capturing large amounts     of encrypted traffic between TLS/SSL server and client     if the communication used a DES/3DES based     ciphersuite.(CVE-2016-2183)

  - The Python standard library HTTP client modules (such     as httplib or urllib) did not perform verification of     TLS/SSL certificates when connecting to HTTPS servers.
    A man-in-the-middle attacker could use this flaw to     hijack connections and eavesdrop or modify transferred     data.(CVE-2014-9365)

  - An integer overflow flaw was found in the way the     buffer() function handled its offset and size     arguments. An attacker able to control those arguments     could use this flaw to disclose portions of the     application memory or cause it to crash.(CVE-2014-7185)

  - A flaw was found in the way catastrophic backtracking     was implemented in python's pop3lib's apop() method. An     attacker could use this flaw to cause denial of     service.(CVE-2018-1060)

  - The ssl.match_hostname function in the SSL module in     Python 2.6 through 3.4 does not properly handle a '\\0'     character in a domain name in the Subject Alternative     Name field of an X.509 certificate, which allows     man-in-the-middle attackers to spoof arbitrary SSL     servers via a crafted certificate issued by a     legitimate Certification Authority, a related issue to     CVE-2009-2408.(CVE-2013-4238)

  - It was found that the Python's httplib library (used by     urllib, urllib2 and others) did not properly check     HTTPConnection.putheader() function arguments. An     attacker could use this flaw to inject additional     headers in a Python application that allowed user     provided header names or values.(CVE-2016-5699)

  - CPython (aka Python) up to 2.7.13 is vulnerable to an     integer overflow in the PyString_DecodeEscape function     in stringobject.c, resulting in heap-based buffer     overflow (and possible arbitrary code     execution)(CVE-2017-1000158)

  - A flaw was found in the way catastrophic backtracking     was implemented in python's difflib.IS_LINE_JUNK     method. An attacker could use this flaw to cause denial     of service.(CVE-2018-1061)

  - It was discovered that multiple Python standard library     modules implementing network protocols (such as httplib     or smtplib) failed to restrict sizes of server     responses. A malicious server could cause a client     using one of the affected modules to consume an     excessive amount of memory.(CVE-2013-1752)

  - A flaw was found in the way the json module handled     negative index argument passed to certain functions     (such as raw_decode()). An attacker able to control     index value passed to one of the affected functions     could possibly use this flaw to disclose portions of     the application memory.(CVE-2014-4616)

  - urllib in Python 2.x through 2.7.16 supports the     local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that     blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd')     call.(CVE-2019-9948)

  - Python's elementtree C accelerator failed to initialise     Expat's hash salt during initialization. This could     make it easy to conduct denial of service attacks     against Expat by contructing an XML document that would     cause pathological hash collisions in Expat's internal     data structures, consuming large amounts CPU and     RAM.(CVE-2018-14647)

  - A null pointer dereference vulnerability was found in     the certificate parsing code in Python. This causes a     denial of service to applications when parsing     specially crafted certificates. This vulnerability is     unlikely to be triggered if application enables SSL/TLS     certificate validation and accepts certificates only     from trusted root certificate     authorities.(CVE-2019-5010)

  - Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is     affected by: Improper Handling of Unicode Encoding     (with an incorrect netloc) during NFKC normalization.
    The impact is: Information disclosure (credentials,     cookies, etc. that are cached against a given     hostname). The components are: urllib.parse.urlsplit,     urllib.parse.urlparse. The attack vector is: A     specially crafted URL could be incorrectly parsed to     locate cookies or authentication data and send that     information to a different host than when parsed     correctly.(CVE-2019-9636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Guido Vranken reports :

HTTP header injection in urrlib2/urllib/httplib/http.client with newlines in header values, where newlines have a semantic consequence of denoting the start of an additional header line.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1626 advisory.

    - Fix for CVE-2016-1000110 HTTPoxy attack     Resolves: rhbz#1359161
    - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)       Raise an error when STARTTLS fails (upstream patch)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python3 to version 3.6.10 fixes the following issues :

CVE-2017-18207: Fixed a denial of service in Wave_read._read_fmt_chunk() (bsc#1083507).

CVE-2019-16056: Fixed an issue where email parsing could fail for multiple @ (bsc#1149955).

CVE-2019-15903: Fixed a heap-based buffer over-read in libexpat (bsc#1149429).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python3 to version 3.6.10 fixes the following issues :

  - CVE-2017-18207: Fixed a denial of service in     Wave_read._read_fmt_chunk() (bsc#1083507).

  - CVE-2019-16056: Fixed an issue where email parsing could     fail for multiple @ (bsc#1149955).

  - CVE-2019-15903: Fixed a heap-based buffer over-read in     libexpat (bsc#1149429).

This update was imported from the SUSE:SLE-15:Update update project.

It was found that Python's httplib library (used urllib, urllib2 and others) did not properly check HTTP header input in HTTPConnection.putheader(). An attacker could use this flow to inject additional headers in a Python application that allows user provided header name or values. (CVE-2016-5699)

It was found that Python's smtplib library did not return an exception if StartTLS fails to establish correctly in the SMTP.starttls() function. An attacker with ability to launch an active man in the middle attack could strip out the STARTTLS command without generating an exception on the python SMTP client application, preventing the establishment of the TLS layer. (CVE-2016-0772)

A vulnerability was discovered in Python, in the built-in zipimporter.
A specially crafted zip file placed in a module path such that it would be loaded by a later 'import' statement could cause a heap overflow, leading to arbitrary code execution. (CVE-2016-5636)

Python was updated to fix three security issues.

The following vulnerabilities were fixed :

  - CVE-2016-0772: TLS stripping attack on smtplib     (bsc#984751)

  - CVE-2016-5636: zipimporter heap overflow (bsc#985177)

  - CVE-2016-5699: httplib header injection (bsc#985348)

This update also includes all upstream bug fixes and improvements in Python 2.7.12.

It also includes the following packaging changes :

  - reintroduce support for CA directory path

The following tracked packaging issues were fixed :

  - broken overflow checks (bsc#964182)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93039	RHEL 6 / 7 : python (RHSA-2016:1626) (httpoxy)	Nessus	Red Hat Local Security Checks	2016/8/19	2026/1/28	medium
99799	EulerOS 2.0 SP1 : python (EulerOS-SA-2016-1036)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	medium
133259	SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:0234-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	2020/1/27	2024/3/28	critical
124937	EulerOS Virtualization 3.0.1.0 : python (EulerOS-SA-2019-1434)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
91911	FreeBSD : Python -- HTTP Header Injection in Python urllib (a61374fc-3a4d-11e6-a671-60a44ce6887b)	Nessus	FreeBSD Local Security Checks	2016/7/1	2021/1/4	medium
93034	Oracle Linux 6 / 7 : python (ELSA-2016-1626)	Nessus	Oracle Linux Local Security Checks	2016/8/19	2026/1/28	medium
133036	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	2020/1/17	2024/3/29	critical
133172	openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	2020/1/22	2024/3/29	critical
92471	Amazon Linux AMI : python26 / python27,python34 (ALAS-2016-724)	Nessus	Amazon Linux Local Security Checks	2016/7/21	2026/1/30	critical
92595	openSUSE Security Update : python (openSUSE-2016-906)	Nessus	SuSE Local Security Checks	2016/7/28	2026/1/30	critical

检测

插件搜索

medium

medium

critical

critical

medium

medium

critical

critical

critical

critical