Skip to content
OpenAdvisories
Medium ALAS2-2020-1484 2 CVEs

Moderate: python3 security update (Amazon Linux 2)

Published Sep 1, 2020 · Updated Sep 2, 2020

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14422: Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. 1854926: CVE-2020-14422 python: DoS via inefficiency in IPv{4,6}Interface classes CVE-2019-20907: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. 1856481: CVE-2019-20907 python: infinite loop in the tarfile module via crafted TAR archive

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python3 0:3.7.9-1.amzn2.0.1
Amazon Linux · 2 python3-debug 0:3.7.9-1.amzn2.0.1
Amazon Linux · 2 python3-debuginfo 0:3.7.9-1.amzn2.0.1
Amazon Linux · 2 python3-devel 0:3.7.9-1.amzn2.0.1
Amazon Linux · 2 python3-libs 0:3.7.9-1.amzn2.0.1
Amazon Linux · 2 python3-test 0:3.7.9-1.amzn2.0.1
Amazon Linux · 2 python3-tkinter 0:3.7.9-1.amzn2.0.1
Amazon Linux · 2 python3-tools 0:3.7.9-1.amzn2.0.1

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-20907.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-14422.html