RHSA-2021:1761 — Red Hat Security Advisory: python27:2.7 security and bug fix update

Fixed packages 120

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	babel	0:2.5.1-9.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	Cython	0:0.28.1-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	Cython-debugsource	0:0.28.1-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy	1:1.14.2-16.module+el8.4.0+9406+221a4565
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy-debugsource	1:1.14.2-16.module+el8.4.0+9406+221a4565
Red Hat · RHEL 8 enterprise_linux:8::appstream	pytest	0:3.4.2-13.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-attrs	0:17.4.0-10.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-backports	0:1.0-16.module+el8.4.0+9193+f3daf6ef
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-backports-ssl_match_hostname	0:3.5.0.1-12.module+el8.4.0+9193+f3daf6ef
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-chardet	0:3.0.4-10.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-coverage	0:4.5.1-4.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-coverage-debugsource	0:4.5.1-4.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-dns	0:1.15.0-10.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-docs	0:2.7.16-2.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-docutils	0:0.14-12.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-funcsigs	0:1.0.2-13.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-idna	0:2.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-ipaddress	0:1.0.18-6.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-jinja2	0:2.10-8.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml	0:4.2.3-4.module+el8.4.0+9319+a932af88
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml-debugsource	0:4.2.3-4.module+el8.4.0+9319+a932af88
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-markupsafe	0:0.23-19.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-mock	0:2.0.0-13.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-nose	0:1.3.7-30.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-nose-docs	0:1.3.7-30.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pluggy	0:0.6.0-8.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2	0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2-debuginfo	0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2-debugsource	0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2-doc	0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-py	0:1.5.3-6.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pygments	0:2.2.0-20.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pymongo	0:3.6.1-11.module+el8.1.0+3446+c3d52da3
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pymongo-debuginfo	0:3.6.1-11.module+el8.1.0+3446+c3d52da3
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pymongo-debugsource	0:3.6.1-11.module+el8.1.0+3446+c3d52da3
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-PyMySQL	0:0.8.0-10.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pysocks	0:1.6.8-6.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pytest-mock	0:1.9.0-4.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-requests	0:2.20.0-3.module+el8.2.0+4577+feefd9b8
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-setuptools_scm	0:1.15.7-6.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-sqlalchemy	0:1.3.2-2.module+el8.3.0+6647+8d010749
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-sqlalchemy-doc	0:1.3.2-2.module+el8.3.0+6647+8d010749
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-urllib3	0:1.24.2-3.module+el8.4.0+9193+f3daf6ef
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-virtualenv	0:15.1.0-19.module+el8.1.0+3507+d69c168d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-wheel	1:0.31.1-2.module+el8.1.0+3725+aac5cd17
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2	0:2.7.18-4.module+el8.4.0+9577+0b56c8de
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-attrs	0:17.4.0-10.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-babel	0:2.5.1-9.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-backports	0:1.0-16.module+el8.4.0+9193+f3daf6ef
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-backports-ssl_match_hostname	0:3.5.0.1-12.module+el8.4.0+9193+f3daf6ef
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-bson	0:3.6.1-11.module+el8.1.0+3446+c3d52da3
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-bson-debuginfo	0:3.6.1-11.module+el8.1.0+3446+c3d52da3
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-chardet	0:3.0.4-10.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-coverage	0:4.5.1-4.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-coverage-debuginfo	0:4.5.1-4.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-Cython	0:0.28.1-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-Cython-debuginfo	0:0.28.1-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-debug	0:2.7.18-4.module+el8.4.0+9577+0b56c8de
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-debuginfo	0:2.7.18-4.module+el8.4.0+9577+0b56c8de
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-debugsource	0:2.7.18-4.module+el8.4.0+9577+0b56c8de
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-devel	0:2.7.18-4.module+el8.4.0+9577+0b56c8de
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-dns	0:1.15.0-10.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-docs	0:2.7.16-2.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-docs-info	0:2.7.16-2.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-docutils	0:0.14-12.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-funcsigs	0:1.0.2-13.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-idna	0:2.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-ipaddress	0:1.0.18-6.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-jinja2	0:2.10-8.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-libs	0:2.7.18-4.module+el8.4.0+9577+0b56c8de
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-lxml	0:4.2.3-4.module+el8.4.0+9319+a932af88
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-lxml-debuginfo	0:4.2.3-4.module+el8.4.0+9319+a932af88
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-markupsafe	0:0.23-19.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-mock	0:2.0.0-13.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-nose	0:1.3.7-30.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-numpy	1:1.14.2-16.module+el8.4.0+9406+221a4565
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-numpy-debuginfo	1:1.14.2-16.module+el8.4.0+9406+221a4565
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-numpy-doc	1:1.14.2-16.module+el8.4.0+9406+221a4565
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-numpy-f2py	1:1.14.2-16.module+el8.4.0+9406+221a4565
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pip	0:9.0.3-18.module+el8.3.0+7707+eb4bba01
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pip-wheel	0:9.0.3-18.module+el8.3.0+7707+eb4bba01
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pluggy	0:0.6.0-8.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-psycopg2	0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-psycopg2-debug	0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-psycopg2-debug-debuginfo	0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-psycopg2-debuginfo	0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-psycopg2-tests	0:2.7.5-7.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-py	0:1.5.3-6.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pygments	0:2.2.0-20.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pymongo	0:3.6.1-11.module+el8.1.0+3446+c3d52da3
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pymongo-debuginfo	0:3.6.1-11.module+el8.1.0+3446+c3d52da3
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pymongo-gridfs	0:3.6.1-11.module+el8.1.0+3446+c3d52da3
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-PyMySQL	0:0.8.0-10.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pysocks	0:1.6.8-6.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pytest	0:3.4.2-13.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pytest-mock	0:1.9.0-4.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pytz	0:2017.2-12.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pyyaml	0:3.12-16.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-pyyaml-debuginfo	0:3.12-16.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-requests	0:2.20.0-3.module+el8.2.0+4577+feefd9b8
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-rpm-macros	0:3-38.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-scipy	0:1.0.0-20.module+el8.1.0+3323+7ac3e00f
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-scipy-debuginfo	0:1.0.0-20.module+el8.1.0+3323+7ac3e00f
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-setuptools	0:39.0.1-13.module+el8.4.0+9442+27d0e81c
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-setuptools_scm	0:1.15.7-6.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-setuptools-wheel	0:39.0.1-13.module+el8.4.0+9442+27d0e81c
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-six	0:1.11.0-6.module+el8.4.0+9287+299307c7
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-sqlalchemy	0:1.3.2-2.module+el8.3.0+6647+8d010749
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-test	0:2.7.18-4.module+el8.4.0+9577+0b56c8de
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-tkinter	0:2.7.18-4.module+el8.4.0+9577+0b56c8de
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-tools	0:2.7.18-4.module+el8.4.0+9577+0b56c8de
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-urllib3	0:1.24.2-3.module+el8.4.0+9193+f3daf6ef
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-virtualenv	0:15.1.0-19.module+el8.1.0+3507+d69c168d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-wheel	1:0.31.1-2.module+el8.1.0+3725+aac5cd17
Red Hat · RHEL 8 enterprise_linux:8::appstream	python2-wheel-wheel	1:0.31.1-2.module+el8.1.0+3725+aac5cd17
Red Hat · RHEL 8 enterprise_linux:8::appstream	pytz	0:2017.2-12.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML	0:3.12-16.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML-debugsource	0:3.12-16.module+el8.1.0+3111+de3f2d8e
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy	0:1.0.0-20.module+el8.1.0+3323+7ac3e00f
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy-debugsource	0:1.0.0-20.module+el8.1.0+3323+7ac3e00f

Vulnerabilities 4

Critical 9.8

CVE-2021-3177 EPSS 24%

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code exec…

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine

Jan 19, 2021
Medium 6.5

CVE-2020-26137

CRLF injection in urllib3

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu Alpine PyPI

Sep 29, 2020
Medium 6.1

CVE-2020-27783

lxml vulnerable to Cross-site Scripting

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML…

lxml lxml lxml python-lxml Debian Ubuntu Azure Linux Alpine PyPI

Dec 3, 2020
Unscored —

CVE-2020-26116

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu

Sep 27, 2020

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1883014
report
https://bugzilla.redhat.com/show_bug.cgi?id=1883632
report
https://bugzilla.redhat.com/show_bug.cgi?id=1886754
report
https://bugzilla.redhat.com/show_bug.cgi?id=1901633
report
https://bugzilla.redhat.com/show_bug.cgi?id=1918168
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1761.json
report
https://access.redhat.com/security/cve/CVE-2020-26116
advisory
https://www.cve.org/CVERecord?id=CVE-2020-26116
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-26116
article
https://python-security.readthedocs.io/vuln/http-header-injection-method.html
report
https://access.redhat.com/security/cve/CVE-2020-26137
advisory
https://www.cve.org/CVERecord?id=CVE-2020-26137
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-26137
report
https://access.redhat.com/security/cve/CVE-2020-27783
advisory
https://www.cve.org/CVERecord?id=CVE-2020-27783
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-27783
report
https://access.redhat.com/security/cve/CVE-2021-3177
advisory
https://www.cve.org/CVERecord?id=CVE-2021-3177
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3177

Red Hat Security Advisory: python27:2.7 security and bug fix update

Fixed packages 120

Vulnerabilities 4

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code exec…

CRLF injection in urllib3

lxml vulnerable to Cross-site Scripting

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF in…

References