RHSA-2020:4641 — Red Hat Security Advisory: python38:3.8 security, bug fix, and enhancement update

Fixed packages 91

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	babel	0:2.7.0-10.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	Cython	0:0.29.14-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	Cython-debugsource	0:0.29.14-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_wsgi	0:4.6.8-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy	0:1.17.3-5.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy-debugsource	0:1.17.3-5.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-asn1crypto	0:1.2.0-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cffi	0:1.13.2-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cffi-debugsource	0:1.13.2-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-chardet	0:3.0.4-19.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cryptography	0:2.8-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cryptography-debugsource	0:2.8-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-idna	0:2.8-6.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-jinja2	0:2.10.3-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml	0:4.4.1-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml-debugsource	0:4.4.1-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-markupsafe	0:1.1.1-6.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-markupsafe-debugsource	0:1.1.1-6.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-ply	0:3.11-8.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psutil	0:5.6.4-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psutil-debugsource	0:5.6.4-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2	0:2.8.4-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2-debugsource	0:2.8.4-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pycparser	0:2.19-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-PyMySQL	0:0.9.3-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pysocks	0:1.7.1-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-requests	0:2.22.0-9.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-six	0:1.12.0-9.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-urllib3	0:1.25.7-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-wheel	0:0.33.6-5.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-asn1crypto	0:1.2.0-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-babel	0:2.7.0-10.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-cffi	0:1.13.2-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-cffi-debuginfo	0:1.13.2-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-chardet	0:3.0.4-19.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-cryptography	0:2.8-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-cryptography-debuginfo	0:2.8-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-Cython	0:0.29.14-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-Cython-debuginfo	0:0.29.14-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-debug	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-debuginfo	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-debugsource	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-devel	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-idle	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-idna	0:2.8-6.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-jinja2	0:2.10.3-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-libs	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-lxml	0:4.4.1-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-lxml-debuginfo	0:4.4.1-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-markupsafe	0:1.1.1-6.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-markupsafe-debuginfo	0:1.1.1-6.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-mod_wsgi	0:4.6.8-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-numpy	0:1.17.3-5.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-numpy-debuginfo	0:1.17.3-5.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-numpy-doc	0:1.17.3-5.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-numpy-f2py	0:1.17.3-5.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pip	0:19.3.1-1.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pip-wheel	0:19.3.1-1.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-ply	0:3.11-8.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psutil	0:5.6.4-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psutil-debuginfo	0:5.6.4-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psycopg2	0:2.8.4-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psycopg2-debuginfo	0:2.8.4-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psycopg2-doc	0:2.8.4-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psycopg2-tests	0:2.8.4-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pycparser	0:2.19-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-PyMySQL	0:0.9.3-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pysocks	0:1.7.1-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pytz	0:2019.3-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pyyaml	0:5.3.1-1.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pyyaml-debuginfo	0:5.3.1-1.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-requests	0:2.22.0-9.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-rpm-macros	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-scipy	0:1.3.1-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-scipy-debuginfo	0:1.3.1-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-setuptools	0:41.6.0-4.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-setuptools-wheel	0:41.6.0-4.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-six	0:1.12.0-9.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-test	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-tkinter	0:3.8.3-3.module+el8.3.0+7680+79e7e61a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-urllib3	0:1.25.7-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-wheel	0:0.33.6-5.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-wheel-wheel	0:0.33.6-5.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-pip	0:19.3.1-1.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-setuptools	0:41.6.0-4.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	pytz	0:2019.3-3.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML	0:5.3.1-1.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML-debugsource	0:5.3.1-1.module+el8.3.0+7187+a27ec44b
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy	0:1.3.1-4.module+el8.2.0+5234+f98739b6
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy-debugsource	0:1.3.1-4.module+el8.2.0+5234+f98739b6

Vulnerabilities 5

Critical 9.8

CVE-2019-20477

Deserialization of Untrusted Data in PyYAML

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

pyyaml pyyaml Debian PyPI

Feb 19, 2020
Critical 9.8

CVE-2020-1747

Improper Input Validation in PyYAML

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the lib…

Red Hat PyYAML pyyaml pyyaml Debian Azure Linux Alpine PyPI

Mar 24, 2020
Medium 6.5

CVE-2020-8492

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine

Jan 30, 2020
Medium 5.5

CVE-2019-20907

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine

Jul 13, 2020
Unscored —

CVE-2020-14422 EPSS 13%

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes…

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu Alpine

Jun 18, 2020

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1806005
report
https://bugzilla.redhat.com/show_bug.cgi?id=1807367
report
https://bugzilla.redhat.com/show_bug.cgi?id=1809065
report
https://bugzilla.redhat.com/show_bug.cgi?id=1815643
report
https://bugzilla.redhat.com/show_bug.cgi?id=1847416
report
https://bugzilla.redhat.com/show_bug.cgi?id=1854926
report
https://bugzilla.redhat.com/show_bug.cgi?id=1856481
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4641.json
report
https://access.redhat.com/security/cve/CVE-2019-20477
advisory
https://www.cve.org/CVERecord?id=CVE-2019-20477
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-20477
report
https://access.redhat.com/security/cve/CVE-2019-20907
advisory
https://www.cve.org/CVERecord?id=CVE-2019-20907
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-20907
report
https://access.redhat.com/security/cve/CVE-2020-1747
advisory
https://www.cve.org/CVERecord?id=CVE-2020-1747
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-1747
report
https://access.redhat.com/security/cve/CVE-2020-8492
advisory
https://www.cve.org/CVERecord?id=CVE-2020-8492
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8492
report
https://access.redhat.com/security/cve/CVE-2020-14422
advisory
https://www.cve.org/CVERecord?id=CVE-2020-14422
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-14422

Red Hat Security Advisory: python38:3.8 security, bug fix, and enhancement update

Fixed packages 91

Vulnerabilities 5

Deserialization of Untrusted Data in PyYAML

Improper Input Validation in PyYAML

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HT…

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes…

References