Red Hat Security Advisory: python27-python and python27-python-jinja2 security and bug fix update

Fixed packages 18

Vulnerabilities 6

• High 8.6
  CVE-2016-10745

  Jinja2 sandbox escape vulnerability

  In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

  jinja2 jinja2 jinja2 Debian Ubuntu PyPI
  Apr 8, 2019
• Medium 6.5
  CVE-2018-1061

  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the di…

  [UNKNOWN] python python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  Jun 19, 2018
• Medium 6.5
  CVE-2019-9740

  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu
  Mar 13, 2019
• Medium 5.4
  CVE-2019-9947

  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux
  Mar 23, 2019
• Medium 5.3
  CVE-2018-14647 EPSS 11%

  Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it eas…

  The Python Project Python python3.4 python3.5 Debian Ubuntu Alpine
  Sep 25, 2018
• Medium 4.3
  CVE-2018-1060

  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3li…

  [UNKNOWN] python python3.4 python3.5 Debian Ubuntu Alpine
  Jun 18, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1549191
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1549192
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1631822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1688169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695572
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1698345
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1709349
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1260.json
• report
  https://access.redhat.com/security/cve/CVE-2016-10745
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-10745
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-10745
• article
  https://palletsprojects.com/blog/jinja-281-released/
• report
  https://access.redhat.com/security/cve/CVE-2018-1060
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1060
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1060
• article
  https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-final
• report
  https://access.redhat.com/security/cve/CVE-2018-1061
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1061
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1061
• report
  https://access.redhat.com/security/cve/CVE-2018-14647
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-14647
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-14647
• article
  https://bugs.python.org/issue34623
• report
  https://access.redhat.com/security/cve/CVE-2019-9740
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9740
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9740
• report
  https://access.redhat.com/security/cve/CVE-2019-9947
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9947
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9947