Red Hat Security Advisory: python security, bug fix, and enhancement update

Fixed packages 32

Vulnerabilities 5

• Medium 5.9
  CVE-2014-4616

  simplejson before 2.6.1 vulnerable to array index error

  Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode functio…

  python3.4 python2.7 python2.7 python2 Debian Ubuntu Alpine PyPI
  Aug 24, 2017
• Unscored —
  CVE-2013-1752 Rejected

  Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of …

  python2.7 Ubuntu
  Jun 3, 2019
• Unscored —
  CVE-2013-1753

  The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a deni…

  python3.4 python2.7 python2.7 Debian Ubuntu
  Mar 11, 2020
• Unscored —
  CVE-2014-4650 Public exploit EPSS 24%

  The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path…

  python3.4 python2.7 python2.7 Debian Ubuntu
  Feb 20, 2020
• Unscored —
  CVE-2014-7185

  Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive inform…

  python2.7 python-py python2.7 Debian Ubuntu Azure Linux
  Oct 8, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/articles/2039753
• article
  https://www.python.org/dev/peps/pep-0466/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1046170
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1046174
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1058482
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1112285
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1113527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1146026
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1173041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1177613
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1181624
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1237107
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1250611
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1259421
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2101.json
• report
  https://access.redhat.com/security/cve/CVE-2013-1752
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-1752
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-1752
• report
  https://access.redhat.com/security/cve/CVE-2013-1753
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-1753
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-1753
• report
  https://access.redhat.com/security/cve/CVE-2014-4616
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-4616
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-4616
• report
  https://access.redhat.com/security/cve/CVE-2014-4650
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-4650
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-4650
• report
  https://access.redhat.com/security/cve/CVE-2014-7185
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-7185
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-7185