Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48560: A use-after-free exists in Python through 3.9 via heappushpop in heapq. CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python | 0:2.7.18-1.amzn2.0.1 |
| Amazon Linux · 2 | python-debug | 0:2.7.18-1.amzn2.0.1 |
| Amazon Linux · 2 | python-debuginfo | 0:2.7.18-1.amzn2.0.1 |
| Amazon Linux · 2 | python-devel | 0:2.7.18-1.amzn2.0.1 |
| Amazon Linux · 2 | python-libs | 0:2.7.18-1.amzn2.0.1 |
| Amazon Linux · 2 | python-test | 0:2.7.18-1.amzn2.0.1 |
| Amazon Linux · 2 | python-tools | 0:2.7.18-1.amzn2.0.1 |
| Amazon Linux · 2 | python3 | 0:3.7.8-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-debug | 0:3.7.8-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-debuginfo | 0:3.7.8-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-devel | 0:3.7.8-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-libs | 0:3.7.8-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-test | 0:3.7.8-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-tkinter | 0:3.7.8-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-tools | 0:3.7.8-1.amzn2.0.1 |
| Amazon Linux · 2 | tkinter | 0:2.7.18-1.amzn2.0.1 |
Vulnerabilities 2
-
Medium 6.5
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…
-
Unscored —
A use-after-free exists in Python through 3.9 via heappushpop in heapq.