Skip to content
OpenAdvisories
Medium ALAS2-2021-1670 2 CVEs

Moderate: python3 security update (Amazon Linux 2)

Published Jun 16, 2021 · Updated Jun 22, 2021

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-27619: In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. 1889886: CVE-2020-27619 python: Unsafe use of eval() on data retrieved via HTTP in the test suite CVE-2020-26116: A flaw was found in Python. The built-in modules httplib and http.client (included in Python 2 and Python 3, respectively) do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity. 1883014: CVE-2020-26116 python: CRLF injection via HTTP request method in httplib/http.client

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 python3 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-debug 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-debuginfo 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-devel 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-libs 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-test 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-tkinter 0:3.7.10-1.amzn2.0.1
Amazon Linux · 2 python3-tools 0:3.7.10-1.amzn2.0.1

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-26116.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-27619.html