Summary
[2.7.5-92.0.1]
- Add Oracle Linux distribution in platform.py [orabug 20812544]
[2.7.5-92]
- Security fix for CVE-2021-3177
Resolves: rhbz#1918168
[2.7.5-91]
- Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
- Test fixes for the latest expat security release
- Update the certificates utilized in the test suite
Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | python | 0:2.7.5-92.0.1.el7_9 |
| Oracle Linux · 7 | python-debug | 0:2.7.5-92.0.1.el7_9 |
| Oracle Linux · 7 | python-devel | 0:2.7.5-92.0.1.el7_9 |
| Oracle Linux · 7 | python-libs | 0:2.7.5-92.0.1.el7_9 |
| Oracle Linux · 7 | python-test | 0:2.7.5-92.0.1.el7_9 |
| Oracle Linux · 7 | python-tools | 0:2.7.5-92.0.1.el7_9 |
| Oracle Linux · 7 | tkinter | 0:2.7.5-92.0.1.el7_9 |
Vulnerabilities 3
-
Critical 9.8CVE-2021-3177 EPSS 24%
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code exec…
-
Medium 6.5
CRLF injection in urllib3
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
-
Unscored —
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…