Red Hat Security Advisory: python27 security, bug fix, and enhancement update

Fixed packages 10

Vulnerabilities 4

• High 7.5
  CVE-2019-20916

  Path Traversal in pip

  The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _d…

  python-pip pip python-pip Debian Ubuntu PyPI
  Sep 4, 2020
• Medium 5.5
  CVE-2019-20907

  In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine
  Jul 13, 2020
• Medium 5.4
  CVE-2019-18348

  An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Oct 23, 2019
• Unscored —
  CVE-2020-26116

  http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…

  python3.4 python3.5 python3.6 python3.8 Debian Ubuntu
  Sep 27, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1727276
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1856481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1868135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1882656
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1883014
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4273.json
• report
  https://access.redhat.com/security/cve/CVE-2019-18348
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-18348
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-18348
• report
  https://access.redhat.com/security/cve/CVE-2019-20907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-20907
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-20907
• report
  https://access.redhat.com/security/cve/CVE-2019-20916
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-20916
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-20916
• report
  https://access.redhat.com/security/cve/CVE-2020-26116
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26116
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26116
• article
  https://python-security.readthedocs.io/vuln/http-header-injection-method.html