Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-debug | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-debuginfo | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-devel | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-idle | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-libs | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-psutil | 0:5.6.4-5.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-psutil-debuginfo | 0:5.6.4-5.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-rpm-macros | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-srpm-macros | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-test | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-tkinter | 0:3.8.6-1.el7 |
| Red Hat · RHEL 3 rhel_software_collections:3::el7 | rh-python38-python-urllib3 | 0:1.25.7-6.el7 |
Vulnerabilities 5
-
High 7.5
Double Free in psutil
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
-
Medium 6.5
CRLF injection in urllib3
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
-
Medium 5.5
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …
-
Unscored —CVE-2020-14422 EPSS 13%
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes…
-
Unscored —
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1772014
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1854926
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1856481
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1883014
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1883632
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1885289
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4299.json
-
report
https://access.redhat.com/security/cve/CVE-2019-18874
-
advisory
https://www.cve.org/CVERecord?id=CVE-2019-18874
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-18874
-
report
https://access.redhat.com/security/cve/CVE-2019-20907
-
advisory
https://www.cve.org/CVERecord?id=CVE-2019-20907
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-20907
-
report
https://access.redhat.com/security/cve/CVE-2020-14422
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-14422
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-14422
-
report
https://access.redhat.com/security/cve/CVE-2020-26116
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-26116
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-26116
-
article
https://python-security.readthedocs.io/vuln/http-header-injection-method.html
-
report
https://access.redhat.com/security/cve/CVE-2020-26137
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-26137
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-26137