Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28861: Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks." CVE-2020-10735: A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python3 | 0:3.7.15-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-debug | 0:3.7.15-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-debuginfo | 0:3.7.15-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-devel | 0:3.7.15-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-libs | 0:3.7.15-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-test | 0:3.7.15-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-tkinter | 0:3.7.15-1.amzn2.0.1 |
| Amazon Linux · 2 | python3-tools | 0:3.7.15-1.amzn2.0.1 |
Vulnerabilities 2
-
Medium 6.5
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multip…
-
Medium 6.2
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text")…