Summary
[2.6.6-66.0.1]
- Add Oracle Linux distribution in platform.py [orabug 21288328] (Keshav Sharma)
[2.6.6-66]
- Fix for CVE-2016-1000110 HTTPoxy attack
Resolves: rhbz#1359161
[2.6.6-65]
- Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
Raise an error when STARTTLS fails (upstream patch)
- Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
Disabled HTTP header injections in httplib (upstream patch)
Resolves: rhbz#1346354
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | python | 0:2.7.5-38.0.1.el7_2 |
| Oracle Linux · 7 | python-debug | 0:2.7.5-38.0.1.el7_2 |
| Oracle Linux · 7 | python-devel | 0:2.7.5-38.0.1.el7_2 |
| Oracle Linux · 7 | python-libs | 0:2.7.5-38.0.1.el7_2 |
| Oracle Linux · 7 | python-test | 0:2.7.5-38.0.1.el7_2 |
| Oracle Linux · 7 | python-tools | 0:2.7.5-38.0.1.el7_2 |
| Oracle Linux · 7 | tkinter | 0:2.7.5-38.0.1.el7_2 |
Vulnerabilities 3
-
Unscored —
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an …
-
Unscored —
The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI scrip…
-
Unscored —CVE-2016-5699 Public exploit
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) bef…