ELSA-2020-4641 — Moderate: python38:3.8 security, bug fix, and enhancement update (Oracle Linux 8)

Fixed packages 42

Release	Package	Fixed in
Oracle Linux · 8	python38	0:3.8.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-asn1crypto	0:1.2.0-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-babel	0:2.7.0-10.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-cffi	0:1.13.2-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-chardet	0:3.0.4-19.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-cryptography	0:2.8-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-Cython	0:0.29.14-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-debug	0:3.8.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-devel	0:3.8.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-idle	0:3.8.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-idna	0:2.8-6.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-jinja2	0:2.10.3-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-libs	0:3.8.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-lxml	0:4.4.1-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-markupsafe	0:1.1.1-6.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-mod_wsgi	0:4.6.8-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-numpy	0:1.17.3-5.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-numpy-doc	0:1.17.3-5.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-numpy-f2py	0:1.17.3-5.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-pip	0:19.3.1-1.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-pip-wheel	0:19.3.1-1.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-ply	0:3.11-8.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-psutil	0:5.6.4-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-psycopg2	0:2.8.4-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-psycopg2-doc	0:2.8.4-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-psycopg2-tests	0:2.8.4-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-pycparser	0:2.19-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-PyMySQL	0:0.9.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-pysocks	0:1.7.1-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-pytz	0:2019.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-pyyaml	0:5.3.1-1.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-requests	0:2.22.0-9.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-rpm-macros	0:3.8.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-scipy	0:1.3.1-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-setuptools	0:41.6.0-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-setuptools-wheel	0:41.6.0-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-six	0:1.12.0-9.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-test	0:3.8.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-tkinter	0:3.8.3-3.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-urllib3	0:1.25.7-4.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-wheel	0:0.33.6-5.module+el8.3.0+7824+e0098946
Oracle Linux · 8	python38-wheel-wheel	0:0.33.6-5.module+el8.3.0+7824+e0098946

Vulnerabilities 5

Critical 9.8

CVE-2019-20477

Deserialization of Untrusted Data in PyYAML

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

pyyaml pyyaml Debian PyPI

Feb 19, 2020
Critical 9.8

CVE-2020-1747

Improper Input Validation in PyYAML

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the lib…

Red Hat PyYAML pyyaml pyyaml Debian Azure Linux Alpine PyPI

Mar 24, 2020
Medium 6.5

CVE-2020-8492

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine

Jan 30, 2020
Medium 5.5

CVE-2019-20907

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine

Jul 13, 2020
Unscored —

CVE-2020-14422 EPSS 13%

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes…

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu Alpine

Jun 18, 2020

Moderate: python38:3.8 security, bug fix, and enhancement update (Oracle Linux 8)

Fixed packages 42

Vulnerabilities 5

Deserialization of Untrusted Data in PyYAML

Improper Input Validation in PyYAML

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes…