Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-27619: In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. 1889886: CVE-2020-27619 python: Unsafe use of eval() on data retrieved via HTTP in the test suite CVE-2020-26116: A flaw was found in Python. The built-in modules httplib and http.client (included in Python 2 and Python 3, respectively) do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity. 1883014: CVE-2020-26116 python: CRLF injection via HTTP request method in httplib/http.client
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python3 | 0:3.7.10-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-debug | 0:3.7.10-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-debuginfo | 0:3.7.10-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-devel | 0:3.7.10-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-libs | 0:3.7.10-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-test | 0:3.7.10-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-tkinter | 0:3.7.10-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-tools | 0:3.7.10-1.amzn2.0.1 |
Vulnerabilities 2
-
Unscored —
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…
-
Unscored —
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via …