Skip to content
OpenAdvisories
Medium ELSA-2023-7034 2 CVEs

Moderate: python39:3.9 and python39-devel:3.9 security update (Oracle Linux 8)

Published Nov 18, 2023 · Updated Nov 18, 2023

Summary

mod_wsgi
[4.7.1-7]
- Bump release for rebuild
Resolves: rhbz#2213595

[4.7.1-6]
- Remove rpath
Resolves: rhbz#2213837

numpy
[1.19.4-3]
- Adjusted the postun scriptlets to enable upgrading to RHEL 9
- Resolves: rhbz#1933055

[1.19.4-2]
- Convert from Fedora to the python39 module in RHEL8
- Resolves: rhbz#1877430

[1:1.19.4-1]
- 1.19.4

[1:1.19.3-1]
- 1.19.3

[1:1.19.2-2]
- Make test suite work in FIPS (140-2) Mode

[1:1.19.2-1]
- 1.19.2

[1:1.19.1-3]
- https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager

[1:1.19.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

[1:1.19.1-1]
- 1.19.1

[1:1.19.0-2]
- Assume old-style numpy provides from python2-numpy

[1:1.19.0-1]
- 1.19.0 final.

[1:1.19.0-0.rc2]
- 1.19.0 rc2

[1:1.18.4-3]
- Rebuilt for Python 3.9

[1:1.18.4-2]
- Own __pycache__ dir, 1833392

[1:1.18.4-1]
- 1.18.4

[1:1.18.3-1]
- 1.18.3

[1:1.18.2-1]
- 1.18.2

[1:1.18.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

[1:1.18.1-1]
- 1.18.1

[1:1.18.0-1]
- 1.18.0

[1:1.17.4-2]
- Backport patch for s390x failures
- Enable non-broken tests on ppc64le

[1:1.17.4-1]
- 1.17.4

[1:1.17.3-1]
- 1.17.3

[1:1.17.2-1]
- 1.17.2

[1:1.17.1-1]
- 1.17.1

[1:1.17.0-3]
- Rebuilt for Python 3.8

[1:1.17.0-2]
- Reintroduce libnpymath.a (#1735674)

[1:1.17.0-1]
- 1.17.0, split out Python 2.

[1:1.16.4-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

[1:1.16.4-2]
- Avoid hardcoding /usr prefix

[1:1.16.4-1]
- 1.16.4

[1:1.16.3-2]
- Build only with openblasp (bugz#1709161)

[1:1.16.3-1]
- 1.16.3.

[1:1.16.2-1]
- 1.16.2.

[1:1.16.1-1]
- 1.16.1.

[1:1.16.0-1]
- 1.16.0.

[1:1.15.1-2]
- Switch to pytest for running tests during check
- Stop ignoring failures when running tests
- Set PATH in check so that f2py tests work
- Update docs to match release
- Remove outdated workaround from rhbz#849713

[1:1.15.1-1]
- Update to latest version

[1:1.15.0-2]
- Fix broken build on s390x
- Remove bytecode produced by pytest
- Re-enable tests on s390x

[1:1.15.0-1]
- 1.15.0

[1:1.14.5-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

[1:1.14.5-2]
- Rebuilt for Python 3.7

[1:1.14.5-1]
- 1.14.5

[1:1.14.3-1]
- 1.14.3

[1:1.14.2-1]
- 1.14.2

[1:1.14.1-1]
- 1.14.1

[1:1.14.0-0.rc1.1]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1:1.14.0-0.rc1]
- 1.14.0 rc1

[1:1.13.3-5]
- Fix ambiguous Python 2 dependency declarations
(See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)

[1:1.13.3-4]
- Split out doc subpackage.

[1:1.13.3-3]
- Cleanup spec file conditionals

[1:1.13.3-2]
- set proper environment variables for openblas

[1:1.13.3-1]
- 1.13.3

[1:1.13.2-1]
- 1.13.2

[1:1.13.1-4]
- Use openblas where available, BZ 1472318.

[1:1.13.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[1:1.13.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1:1.13.1-1]
- 1.13.1 final

[1:1.13.0-1]
- 1.13.0 final

[1:1.13.0-0.rc2]
- 1.13.0 rc2

[1:1.13.0-0.rc1]
- 1.13.0 rc1

[1:1.12.1-1]
- 1.12.1

[1:1.12.0-1]
- Update to 1.12.0, build with gcc 7.0.

[1:1.11.2-2]
- Rebuild for Python 3.6

[1:1.11.2-1]
- Update to 1.11.2 final

[1:1.11.2-0.rc1]
- Update to 1.11.2rc1, BZ 1340440.

[1:1.11.1-2]
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages

[1:1.11.1-1]
- Update to 1.11.1 final

[1:1.11.1-0.rc1]
- Update to 1.11.1rc1, BZ 1340440.

[1:1.11.0-4]
- Update to 1.11.0 final

[1:1.11.0-3.rc2]
- Update to 1.11.0rc2

[1:1.11.0-2.b3]
- Bump Release. 1b2 is higher than 0b3

[1:1.11.0-0.b3]
- Update to 1.11.0b2, BZ 1306249.

[1:1.11.0-1b2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[1:1.11.0-0.b2]
- Update to 1.11.0b2, BZ 1303387.

[1:1.11.0-020161016.cc2b04git]
- Update to git snapshot (due to build issue) after 1.11.0b1, BZ 1301943.

[1:1.10.4-1]
- Update to 1.10.4, BZ 1296509.

[1:1.10.2-1]
- Update to 1.10.2, BZ 1291674.

[1:1.10.2-0.2.rc2]
- Update to 1.10.2rc1, BZ 1289550.

[1:1.10.2-0.1.rc1]
- Update to 1.10.2rc1
- Drop opt-flags patch applied upstream

[1:1.10.1-6]
- Add provides to satisfy numpy%{_isa} requires in other packages

[1:1.10.1-5]
- Re-add provides f2py

[1:1.10.1-4]
- Fix obsoletes / provides for numpy -> python2-numpy rename

[1:1.10.1-3]
- Remove fortran flags or arm would build with -march=x86-64

[1:1.10.1-2]
- Provide python2-* packages
- Run tests with verbose=2

[1:1.10.1-1]
- Update to 1.10.1, BZ 1271022.

[1:1.10.0-2]
- Rebuilt for Python3.5 rebuild

[1:1.10.0-1]
- Update to 1.10.0 final.

[1:1.10.0-0.b1]
- Update to 1.10.0b1, BZ 1252641.

[1:1.9.2-3]
- Add python2-numpy provides (bug #1249423)
- Spec cleanup

[1:1.9.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[1:1.9.2-1]
- Update to 1.9.2

[1:1.9.1-2]
- Add upstream patch to fix xerbla linkage (bug #1172834)

[1:1.9.1-1]
- Update to 1.9.1, BZ 1160273.

[1:1.9.0-1]
- Update to 1.9.0

[1:1.9.0-0.1.rc1]
- Update to 1.9.0rc1

[1:1.8.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild

[1:1.8.2-1]
- Update to 1.8.2

[1:1.8.1-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

[1:1.8.1-3]
- Rebuild for Python 3.4

[1:1.8.1-2]
- Fixing FTBFS on ppc64le (#1078354)

[1:1.8.1-1]
- Update to 1.8.1

[1:1.8.0-5]
- Fix __pycache__ ownership (bug #1072467)

[1:1.8.0-4]
- Fix CVE-2014-1858, CVE-2014-1859: #1062009, #1062359

[1:1.8.0-3]
- Ship doc module (bug #1034357)

[1:1.8.0-2]
- Move f2py documentation to f2py package (bug #1027394)

[1:1.8.0-1]
- Update to 1.8.0 final

[1:1.8.0-0.7.rc2]
- Update to 1.8.0rc2
- Create clean site.cfg
- Use serial atlas

[1:1.8.0-0.6.b2]
- Add [atlas] to site.cfg for new atlas library names

[1:1.8.0-0.5.b2]
- Update site.cfg for new atlas library names

[1:1.8.0-0.4.b2]
- rebuild for atlas 3.10

[1:1.8.0-0.3.b2]
- Fix libdir path in site.cfg, BZ 1006242.

[1:1.8.0-0.2.b2]
- Update to 1.8.0b2

[1:1.8.0-0.1.b1]
- Update to

Fixed packages 49

ReleasePackageFixed in
Oracle Linux · 8 python39 0:3.9.18-1.module+el8.9.0+90071+8dc52a4f
Oracle Linux · 8 python39-attrs 0:20.3.0-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-cffi 0:1.14.3-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-chardet 0:3.0.4-19.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-cryptography 0:3.3.1-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-Cython 0:0.29.21-5.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-debug 0:3.9.18-1.module+el8.9.0+90071+8dc52a4f
Oracle Linux · 8 python39-devel 0:3.9.18-1.module+el8.9.0+90071+8dc52a4f
Oracle Linux · 8 python39-idle 0:3.9.18-1.module+el8.9.0+90071+8dc52a4f
Oracle Linux · 8 python39-idna 0:2.10-3.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-iniconfig 0:1.1.1-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-libs 0:3.9.18-1.module+el8.9.0+90071+8dc52a4f
Oracle Linux · 8 python39-lxml 0:4.6.5-1.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-mod_wsgi 0:4.7.1-7.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-more-itertools 0:8.5.0-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-numpy 0:1.19.4-3.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-numpy-doc 0:1.19.4-3.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-numpy-f2py 0:1.19.4-3.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-packaging 0:20.4-4.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pip 0:20.2.4-8.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pip-wheel 0:20.2.4-8.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pluggy 0:0.13.1-3.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-ply 0:3.11-10.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-psutil 0:5.8.0-4.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-psycopg2 0:2.8.6-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-psycopg2-doc 0:2.8.6-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-psycopg2-tests 0:2.8.6-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-py 0:1.10.0-1.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pybind11 0:2.7.1-1.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pybind11-devel 0:2.7.1-1.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pycparser 0:2.20-3.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-PyMySQL 0:0.10.1-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pyparsing 0:2.4.7-5.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pysocks 0:1.7.1-4.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pytest 0:6.0.2-2.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-pyyaml 0:5.4.1-1.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-requests 0:2.25.0-3.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-rpm-macros 0:3.9.18-1.module+el8.9.0+90071+8dc52a4f
Oracle Linux · 8 python39-scipy 0:1.5.4-5.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-setuptools 0:50.3.2-4.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-setuptools-wheel 0:50.3.2-4.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-six 0:1.15.0-3.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-test 0:3.9.18-1.module+el8.9.0+90071+8dc52a4f
Oracle Linux · 8 python39-tkinter 0:3.9.18-1.module+el8.9.0+90071+8dc52a4f
Oracle Linux · 8 python39-toml 0:0.10.1-5.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-urllib3 0:1.25.10-4.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-wcwidth 0:0.2.5-3.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-wheel 1:0.35.1-4.module+el8.9.0+90016+9c2d6573
Oracle Linux · 8 python39-wheel-wheel 1:0.35.1-4.module+el8.9.0+90016+9c2d6573

Vulnerabilities 2

  • Critical 9.8
    CVE-2007-4559 Public exploit EPSS 27%

    Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allow…

  • Medium 6.1
    CVE-2023-32681 Public exploit

    Unintended leak of Proxy-Authorization header in requests

    Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header…