This update for python fixes the following issues :

Security issues fixed :

  - CVE-2019-5010: Fixed a denial-of-service vulnerability     in the X509 certificate parser (bsc#1122191).

  - CVE-2018-14647: Fixed a denial-of-service vulnerability     in Expat (bsc#1109847).

Non-security issue fixed :

  - Fixed a bug where PyWeakReference struct was not     initialized correctly leading to a crash (bsc#1073748).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Python's elementtree C accelerator failed to initialise     Expat's hash salt during initialization. This could     make it easy to conduct denial of service attacks     against Expat by contructing an XML document that would     cause pathological hash collisions in Expat's internal     data structures, consuming large amounts CPU and     RAM.(CVE-2018-14647)

  - A null pointer dereference vulnerability was found in     the certificate parsing code in Python. This causes a     denial of service to applications when parsing     specially crafted certificates. This vulnerability is     unlikely to be triggered if application enables SSL/TLS     certificate validation and accepts certificates only     from trusted root certificate     authorities.(CVE-2019-5010)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Python is an interpreted, interactive, object-oriented     programming language, which includes modules, classes,     exceptions, very high level dynamic data types and     dynamic typing. Python supports interfaces to many     system calls and libraries, as well as to various     windowing systems.Security Fix(es):A security     regression of CVE-2019-9636 was discovered in python,     since commit d537ab0ff9767ef024f26246899728f0116b1ec3,     which still allows an attacker to exploit CVE-2019-9636     by abusing the user and password parts of a URL. When     an application parses user-supplied URLs to store     cookies, authentication credentials, or other kind of     information, it is possible for an attacker to provide     specially crafted URLs to make the application locate     host-related information (e.g. cookies, authentication     data) and send them to a different host than where it     should, unlike if the URLs had been correctly parsed.
    The result of an attack may vary based on the     application.(CVE-2019-10160)urllib in Python 2.x     through 2.7.16 supports the local_file: scheme, which     makes it easier for remote attackers to bypass     protection mechanisms that blacklist file: URIs, as     demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd')     call.(CVE-2019-9948)Python's elementtree C accelerator     failed to initialise Expat's hash salt during     initialization. This could make it easy to conduct     denial of service attacks against Expat by constructing     an XML document that would cause pathological hash     collisions in Expat's internal data structures,     consuming large amounts CPU and     RAM.(CVE-2018-14647)python 2.7.14 is vulnerable to a     Heap-Buffer-Overflow as well as a Heap-Use-After-Free.
    Python versions prior to 2.7.14 may also be vulnerable     and it appears that Python 2.7.17 and prior may also be     vulnerable however this has not been confirmed. The     vulnerability lies when multiply threads are handling     large amounts of data. In both cases there is     essentially a race condition that occurs. For the     Heap-Buffer-Overflow, Thread 2 is creating the size for     a buffer, but Thread1 is already writing to the buffer     without knowing how much to write. So when a large     amount of data is being processed, it is very easy to     cause memory corruption using a Heap-Buffer-Overflow.
    As for the Use-After-Free,     Thread3-i1/4zMalloc-i1/4zThread1-i1/4zFree's-i1/4zThread2-Re-us     es-Free'd Memory. The PSRT has stated that this is not     a security vulnerability due to the fact that the     attacker must be able to run code, however in some     situations, such as function as a service, this     vulnerability can potentially be used by an attacker to     violate a trust boundary, as such the DWF feels this     issue deserves a CVE.(CVE-2018-1000030)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1268 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib     (CVE-2018-1061)

    * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)

    * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

    * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

    * python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

    * python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib (CVE-2018-1060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.16. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.2 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3725 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: rh-python36-python (3.6.9).
    (BZ#1709344)

    Security Fix(es):

    * python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib     (CVE-2018-1061)

    * python: Missing salt initialization in _elementtree.c module (CVE-2018-14647)

    * python: Cookie domain check returns incorrect results (CVE-2018-20852)

    * python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)

    * python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

    * python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

    * python: email.utils.parseaddr wrongly parses email addresses (CVE-2019-16056)

    * python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib (CVE-2018-1060)

    * python: Integer overflow in Modules/_pickle.c allows for memory exhaustion if serializing gigabytes of     data (CVE-2018-20406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * urlsplit doesn't accept a NFKD hostname with a port number (BZ#1709340)

    * rh-python36 cannot unpickle datetime.date objects (BZ#1749103)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
122642	openSUSE Security Update : python (openSUSE-2019-292)	Nessus	SuSE Local Security Checks	2019/3/6	2024/6/17	high
124735	EulerOS Virtualization 2.5.3 : python (EulerOS-SA-2019-1357)	Nessus	Huawei Local Security Checks	2019/5/10	2024/5/24	high
129212	EulerOS 2.0 SP3 : python (EulerOS-SA-2019-2019)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	critical
135089	RHEL 7 : python (RHSA-2020:1268)	Nessus	Red Hat Local Security Checks	2020/4/1	2024/11/7	critical
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	2022/9/1	2025/7/22	critical
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical
194161	RHEL 6 / 7 : rh-python36-python (RHSA-2019:3725)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	critical

检测

插件搜索

high

high

critical

critical

critical

critical

critical