Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14422: Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. 1854926: CVE-2020-14422 python: DoS via inefficiency in IPv{4,6}Interface classes CVE-2019-20907: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. 1856481: CVE-2019-20907 python: infinite loop in the tarfile module via crafted TAR archive
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python3 | 0:3.7.9-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-debug | 0:3.7.9-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-debuginfo | 0:3.7.9-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-devel | 0:3.7.9-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-libs | 0:3.7.9-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-test | 0:3.7.9-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-tkinter | 0:3.7.9-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-tools | 0:3.7.9-1.amzn2.0.1 |
Vulnerabilities 2
-
Medium 5.5
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …
-
Unscored —CVE-2020-14422 EPSS 13%
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes…