Summary
[3.6.8-15.1.0.1]
- Add Oracle Linux distribution in platform.py [Orabug: 20812544]
[3.6.8-15.1]
- Patch 329 (FIPS) modified: Added workaround for mod_ssl:
Skip error checking in _Py_hashlib_fips_error
Resolves: rhbz#1760106
[3.6.8-15]
- Patch 329 that adds support for OpenSSL FIPS mode has been improved and
bugfixed
Resolves: rhbz#1744670 rhbz#1745499 rhbz#1745685
[3.6.8-14]
- Adding a new patch 329 that adds support for OpenSSL FIPS mode
- Explicitly listing man pages in files section to fix an RPM warning
Resolves: rhbz#1731424
[3.6.8-13]
- Do not set PHA verify flag on client side (rhbz#1725721)
- Enable TLS 1.3 post-handshake authentication in http.client (rhbz#1671353)
[3.6.8-12]
- Use RPM built wheels of pip and setuptools in ensurepip instead of our rewheel patch
- Require platform-python-setuptools from platform-python-devel to prevent packaging errors
Resolves: rhbz#1701286
[3.6.8-11]
- Fix for CVE-2019-10160
Resolves: rhbz#1689318
[3.6.8-10]
- Security fix for CVE-2019-9948
Resolves: rhbz#1714643
[3.6.8-9]
- Reduced default build flags used to build extension modules
https://fedoraproject.org/wiki/Changes/Python_Extension_Flags
Resolves: rhbz#1634784
[3.6.8-8]
- gzip the unversioned-python man page
Resolves: rhbz#1665514
[3.6.8-7]
- Disallow control chars in http URLs
- Fixes CVE-2019-9740 and CVE-2019-9947
Resolves: rhbz#1704365 and rhbz#1703531
[3.6.8-6]
- Updated fix for CVE-2019-9636 (rhbz#1689318)
[3.6.8-5]
- Security fix for CVE-2019-9636 (rhbz#1689318)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | platform-python | 0:3.6.8-15.1.0.1.el8 |
| Oracle Linux · 8 | platform-python-debug | 0:3.6.8-15.1.0.1.el8 |
| Oracle Linux · 8 | platform-python-devel | 0:3.6.8-15.1.0.1.el8 |
| Oracle Linux · 8 | python3-idle | 0:3.6.8-15.1.0.1.el8 |
| Oracle Linux · 8 | python3-libs | 0:3.6.8-15.1.0.1.el8 |
| Oracle Linux · 8 | python3-test | 0:3.6.8-15.1.0.1.el8 |
| Oracle Linux · 8 | python3-tkinter | 0:3.6.8-15.1.0.1.el8 |
Vulnerabilities 4
-
Critical 9.1CVE-2019-9948 EPSS 12%
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypa…
-
Medium 6.5
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …
-
Medium 5.9
An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.…
-
Medium 5.4
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …