Red Hat Security Advisory: rh-python36 security, bug fix, and enhancement update

Fixed packages 20

Vulnerabilities 7

• High 7.5
  CVE-2019-20916

  Path Traversal in pip

  The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _d…

  python-pip pip python-pip Debian Ubuntu PyPI
  Sep 4, 2020
• Medium 6.5
  CVE-2020-8492

  Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Jan 30, 2020
• Medium 6.1
  CVE-2019-16935

  The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the s…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Sep 28, 2019
• Medium 5.5
  CVE-2019-20907

  In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine
  Jul 13, 2020
• Medium 5.4
  CVE-2019-18348

  An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection …

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Oct 23, 2019
• Unscored —
  CVE-2020-14422 EPSS 13%

  Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes…

  python3.4 python3.5 python3.6 python3.8 Debian Ubuntu Alpine
  Jun 18, 2020
• Unscored —
  CVE-2020-26116

  http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…

  python3.4 python3.5 python3.6 python3.8 Debian Ubuntu
  Sep 27, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1727276
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1763229
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1809065
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1826520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1854926
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1856481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1868135
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1873080
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1883014
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4285.json
• report
  https://access.redhat.com/security/cve/CVE-2019-16935
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16935
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16935
• report
  https://access.redhat.com/security/cve/CVE-2019-18348
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-18348
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-18348
• report
  https://access.redhat.com/security/cve/CVE-2019-20907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-20907
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-20907
• report
  https://access.redhat.com/security/cve/CVE-2019-20916
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-20916
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-20916
• report
  https://access.redhat.com/security/cve/CVE-2020-8492
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-8492
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-8492
• report
  https://access.redhat.com/security/cve/CVE-2020-14422
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-14422
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-14422
• report
  https://access.redhat.com/security/cve/CVE-2020-26116
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-26116
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-26116
• article
  https://python-security.readthedocs.io/vuln/http-header-injection-method.html