Red Hat Security Advisory: python security and bug fix update

Fixed packages 32

Vulnerabilities 5

• Critical 9.1
  CVE-2019-9948 EPSS 12%

  urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypa…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Mar 23, 2019
• Medium 6.5
  CVE-2019-9740

  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu
  Mar 13, 2019
• Medium 5.9
  CVE-2019-5010 Public exploit EPSS 21%

  An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Oct 31, 2019
• Medium 5.4
  CVE-2019-9947

  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux
  Mar 23, 2019
• Medium 5.3
  CVE-2018-14647 EPSS 11%

  Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it eas…

  The Python Project Python python3.4 python3.5 Debian Ubuntu Alpine
  Sep 25, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1629982
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1631822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1666519
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1688169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695570
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695572
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1703600
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2030.json
• report
  https://access.redhat.com/security/cve/CVE-2018-14647
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-14647
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-14647
• article
  https://bugs.python.org/issue34623
• report
  https://access.redhat.com/security/cve/CVE-2019-5010
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-5010
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-5010
• article
  https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html
• report
  https://access.redhat.com/security/cve/CVE-2019-9740
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9740
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9740
• report
  https://access.redhat.com/security/cve/CVE-2019-9947
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9947
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9947
• report
  https://access.redhat.com/security/cve/CVE-2019-9948
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9948
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9948