Red Hat Security Advisory: rh-python36-python security, bug fix, and enhancement update

Fixed packages 16

Vulnerabilities 10

• Critical 9.1
  CVE-2019-9948 EPSS 12%

  urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypa…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Mar 23, 2019
• Medium 6.5
  CVE-2018-1061

  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the di…

  [UNKNOWN] python python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  Jun 19, 2018
• Medium 6.5
  CVE-2019-9740

  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu
  Mar 13, 2019
• Medium 5.9
  CVE-2019-5010 Public exploit EPSS 21%

  An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Oct 31, 2019
• Medium 5.4
  CVE-2019-9947

  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux
  Mar 23, 2019
• Medium 5.3
  CVE-2018-14647 EPSS 11%

  Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it eas…

  The Python Project Python python3.4 python3.5 Debian Ubuntu Alpine
  Sep 25, 2018
• Medium 5.3
  CVE-2019-16056

  An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine
  Sep 6, 2019
• Medium 4.3
  CVE-2018-1060

  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3li…

  [UNKNOWN] python python3.4 python3.5 Debian Ubuntu Alpine
  Jun 18, 2018
• Medium 4.3
  CVE-2018-20852

  http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly valida…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu
  Jul 13, 2019
• Unscored —
  CVE-2018-20406

  Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled durin…

  python3.4 python3.5 python3.6 python3 Ubuntu Alpine
  Dec 23, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1549191
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1549192
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1631822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1664509
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1666519
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1688169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695572
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1709344
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1740347
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1749103
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1749839
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3725.json
• report
  https://access.redhat.com/security/cve/CVE-2018-1060
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1060
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1060
• article
  https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-final
• report
  https://access.redhat.com/security/cve/CVE-2018-1061
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1061
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1061
• report
  https://access.redhat.com/security/cve/CVE-2018-14647
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-14647
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-14647
• article
  https://bugs.python.org/issue34623
• report
  https://access.redhat.com/security/cve/CVE-2018-20406
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-20406
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-20406
• article
  https://python-security.readthedocs.io/vuln/pickle-load-dos.html
• report
  https://access.redhat.com/security/cve/CVE-2018-20852
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-20852
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-20852
• report
  https://access.redhat.com/security/cve/CVE-2019-5010
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-5010
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-5010
• article
  https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html
• report
  https://access.redhat.com/security/cve/CVE-2019-9740
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9740
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9740
• report
  https://access.redhat.com/security/cve/CVE-2019-9947