An update of the python3 package has been released.

An update of the python2 package has been released.

## Python 3.8.3

This is the third maintenance release of Python 3.8. See [the changelog](https://docs.python.org/release/3.8.3/whatsnew/changelog.ht ml#changelog) for details. Contains the security fix for CVE-2020-8492.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5200-1 advisory.

    It was discovered that the urllib.request.AbstractBasicAuthHandler class

    in Python contains regex allowing for catastrophic backtracking. Specially

    crafted traffic from a malicious HTTP server could cause a regular expression

    denial of service (ReDoS) condition for a client. (CVE-2020-8492)

    It was discovered that the urllib.request.AbstractBasicAuthHandler class

    in Python contains regex with a quadratic worst-case time complexity.

    Specially crafted traffic from a malicious HTTP server could cause a regular

    expression denial of service (ReDoS) condition for a client. (CVE-2021-3733)

    It was discovered that the Python urllib http client could enter into an infinite

    loop when incorrectly handling certain server responses (100 Continue response).

    Specially crafted traffic from a malicious HTTP server could cause a denial of

    service (DoS) condition for a client. (CVE-2021-3737)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python3 fixes the following issues :

Fixed CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support calls eval() on content retrieved via HTTP.

Change setuptools and pip version numbers according to new wheels

Handful of changes to make python36 compatible with SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738)

add triplets for mips-r6 and riscv

RISC-V needs CTYPES_PASS_BY_REF_HACK

Update to 3.6.12 (bsc#1179193)

Ensure python3.dll is loaded from correct locations when Python is embedded

The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address).

Prevent http header injection by rejecting control characters in http.client.putrequest(&acirc;&#128;&brvbar;).

Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing.

Avoid infinite loop when reading specially crafted TAR files using the tarfile module

This release also fixes CVE-2020-26116 (bsc#1177211) and CVE-2019-20907 (bsc#1174091).

Update to 3.6.11 :

Disallow CR or LF in email.headerregistry. Address arguments to guard against header injection attacks.

Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised. (bsc#1155094)

CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6     through 3.6.10, 3.7 through 3.7.6, and 3.8 through     3.8.1 allows an HTTP server to conduct Regular     Expression Denial of Service (ReDoS) attacks against a     client because of     urllib.request.AbstractBasicAuthHandler catastrophic     backtracking.(CVE-2020-8492)

  - Lib/zipfile.py in Python through 3.7.2 allows remote     attackers to cause a denial of service (resource     consumption) via a ZIP bomb.(CVE-2019-9674)

  - ** DISPUTED ** The Wave_read._read_fmt_chunk function     in Lib/wave.py in Python through 3.6.4 does not ensure     a nonzero channel value, which allows attackers to     cause a denial of service (divide-by-zero and     exception) via a crafted wav format audio file. NOTE:
    the vendor disputes this issue because Python     applications 'need to be prepared to handle a wide     variety of exceptions.'(CVE-2017-18207)

  - Python Software Foundation Python (CPython) version 2.7     contains a CWE-77: Improper Neutralization of Special     Elements used in a Command ('Command Injection')     vulnerability in shutil module (make_archive function)     that can result in Denial of service, Information gain     via injection of arbitrary files on the system or     entire drive. This attack appear to be exploitable via     Passage of unfiltered user input to the function. This     vulnerability appears to have been fixed in after     commit     add531a1e55b0a739b0f42582f1c9747e5649ace.(CVE-2018-1000     802)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3888 advisory.

    - Security fix for CVE-2020-8492     Resolves: rhbz#1810616
    - Security fix for CVE-2019-16935     Resolves: rhbz#1797999

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4333-2 advisory.

    USN-4333-1 fixed vulnerabilities in Python. This update provides the corresponding update for Ubuntu 20.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python to version 2.7.17 fixes the following issues :

Syncing with lots of upstream bug fixes and security fixes.

Bug fixes :

CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825).

CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094).

CVE-2020-8492: Fixed a regular expression in urllib that was prone to denial of service via HTTP (bsc#1162367).

Fixed mismatches between libpython and python-base versions (bsc#1162224).

Fixed segfault in libpython2.7.so.1 (bsc#1073748).

Unified packages among openSUSE:Factory and SLE versions (bsc#1159035).

Added idle.desktop and idle.appdata.xml to provide IDLE in menus (bsc#1153830).

Excluded tsl_check files from python-base to prevent file conflict with python-strict-tls-checks package (bsc#945401).

Changed the name of idle3 icons to idle3.png to avoid collision with Python 2 version (bsc#1165894).

Additionally a new 'shared-python-startup' package is provided containing startup files.

python-rpm-macros was updated to fix :

Do not write .pyc files for tests (bsc#1171561)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of python27 installed on the remote host is prior to 2.7.18-1.138. The version of python34 installed on the remote host is prior to 3.4.10-1.50. The version of python35 installed on the remote host is prior to 3.5.7-1.26. The version of python36 installed on the remote host is prior to 3.6.11-1.17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1407 advisory.

    Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135299	Photon OS 2.0: Python3 PHSA-2020-2.0-0226	Nessus	PhotonOS Local Security Checks	2020/4/10	2024/7/22	medium
135492	Photon OS 1.0: Python2 PHSA-2020-1.0-0288	Nessus	PhotonOS Local Security Checks	2020/4/15	2024/3/18	medium
203102	Photon OS 2.0: Python2 PHSA-2020-2.0-0227	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	medium
136954	Fedora 31 : python38 (2020-6a88dad4a0)	Nessus	Fedora Local Security Checks	2020/5/29	2024/3/8	medium
137118	Fedora 32 : python3 (2020-98e0f0f11b)	Nessus	Fedora Local Security Checks	2020/6/4	2024/3/7	medium
156171	Ubuntu 18.04 LTS : Python vulnerabilities (USN-5200-1)	Nessus	Ubuntu Local Security Checks	2021/12/18	2024/8/27	high
144586	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:3930-1)	Nessus	SuSE Local Security Checks	2020/12/24	2024/1/31	critical
137488	EulerOS 2.0 SP2 : python (EulerOS-SA-2020-1646)	Nessus	Huawei Local Security Checks	2020/6/17	2024/3/6	critical
141218	Oracle Linux 7 : python3 (ELSA-2020-3888)	Nessus	Oracle Linux Local Security Checks	2020/10/7	2024/10/22	medium
136281	Ubuntu 20.04 LTS : Python vulnerabilities (USN-4333-2)	Nessus	Ubuntu Local Security Checks	2020/5/1	2024/10/29	medium
137580	SUSE SLES12 Security Update : python (SUSE-SU-2020:1524-1)	Nessus	SuSE Local Security Checks	2020/6/18	2024/3/6	medium
139087	Amazon Linux AMI : python27, python34, python35, python36 (ALAS-2020-1407)	Nessus	Amazon Linux Local Security Checks	2020/7/30	2024/12/11	medium

检测

插件搜索

medium

medium

medium

medium

medium

high

critical

critical

medium

medium

medium

medium