RHSA-2021:4160 — Red Hat Security Advisory: python39:3.9 and python39-devel:3.9 security update

Fixed packages 102

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_wsgi	0:4.7.1-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy	0:1.19.4-3.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy-debugsource	0:1.19.4-3.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cffi	0:1.14.3-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cffi-debugsource	0:1.14.3-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-chardet	0:3.0.4-19.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cryptography	0:3.3.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cryptography-debugsource	0:3.3.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-idna	0:2.10-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml	0:4.6.2-3.module+el8.5.0+10536+a233b742
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml-debugsource	0:4.6.2-3.module+el8.5.0+10536+a233b742
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-ply	0:3.11-10.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psutil	0:5.8.0-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psutil-debugsource	0:5.8.0-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2	0:2.8.6-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2-debugsource	0:2.8.6-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pycparser	0:2.20-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-PyMySQL	0:0.10.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pysocks	0:1.7.1-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-requests	0:2.25.0-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-toml	0:0.10.1-5.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-urllib3	0:1.25.10-4.module+el8.5.0+11712+ea2d2be1
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-wheel	1:0.35.1-4.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-cffi	0:1.14.3-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-cffi-debuginfo	0:1.14.3-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-chardet	0:3.0.4-19.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-cryptography	0:3.3.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-cryptography-debuginfo	0:3.3.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-debuginfo	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-debugsource	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-devel	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-idle	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-idna	0:2.10-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-libs	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-lxml	0:4.6.2-3.module+el8.5.0+10536+a233b742
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-lxml-debuginfo	0:4.6.2-3.module+el8.5.0+10536+a233b742
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-mod_wsgi	0:4.7.1-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-numpy	0:1.19.4-3.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-numpy-debuginfo	0:1.19.4-3.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-numpy-doc	0:1.19.4-3.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-numpy-f2py	0:1.19.4-3.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pip	0:20.2.4-6.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pip-wheel	0:20.2.4-6.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-ply	0:3.11-10.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psutil	0:5.8.0-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psutil-debuginfo	0:5.8.0-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psycopg2	0:2.8.6-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psycopg2-debuginfo	0:2.8.6-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psycopg2-doc	0:2.8.6-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-psycopg2-tests	0:2.8.6-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pycparser	0:2.20-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-PyMySQL	0:0.10.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pysocks	0:1.7.1-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pyyaml	0:5.4.1-1.module+el8.5.0+10613+59a13ec4
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-pyyaml-debuginfo	0:5.4.1-1.module+el8.5.0+10613+59a13ec4
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-requests	0:2.25.0-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-rpm-macros	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-scipy	0:1.5.4-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-scipy-debuginfo	0:1.5.4-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-setuptools	0:50.3.2-4.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-setuptools-wheel	0:50.3.2-4.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-six	0:1.15.0-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-test	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-tkinter	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-toml	0:0.10.1-5.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-urllib3	0:1.25.10-4.module+el8.5.0+11712+ea2d2be1
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-wheel	1:0.35.1-4.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python39-wheel-wheel	1:0.35.1-4.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-pip	0:20.2.4-6.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-setuptools	0:50.3.2-4.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-six	0:1.15.0-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML	0:5.4.1-1.module+el8.5.0+10613+59a13ec4
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML-debugsource	0:5.4.1-1.module+el8.5.0+10613+59a13ec4
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy	0:1.5.4-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy-debugsource	0:1.5.4-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	Cython	0:0.29.21-5.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	Cython-debugsource	0:0.29.21-5.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	pybind11	0:2.6.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	pytest	0:6.0.2-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python-attrs	0:20.3.0-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python-iniconfig	0:1.1.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python-more-itertools	0:8.5.0-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python-packaging	0:20.4-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python-pluggy	0:0.13.1-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python-py	0:1.10.0-1.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python-wcwidth	0:0.2.5-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-attrs	0:20.3.0-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-Cython	0:0.29.21-5.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-Cython-debuginfo	0:0.29.21-5.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-debug	0:3.9.6-2.module+el8.5.0+12204+54860423
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-iniconfig	0:1.1.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-more-itertools	0:8.5.0-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-packaging	0:20.4-4.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pluggy	0:0.13.1-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-py	0:1.10.0-1.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pybind11	0:2.6.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pybind11-devel	0:2.6.1-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pyparsing	0:2.4.7-5.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-pytest	0:6.0.2-2.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python39-wcwidth	0:0.2.5-3.module+el8.4.0+9822+20bf1249
Red Hat · RHEL 8 enterprise_linux:8::crb	python3x-pyparsing	0:2.4.7-5.module+el8.4.0+9822+20bf1249

Vulnerabilities 7

High 7.5

CVE-2021-33503

Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a para…

python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu Azure Linux PyPI

Jun 29, 2021
High 7.5

CVE-2021-3737 EPSS 13%

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote at…

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu

Mar 4, 2022
Medium 6.1

CVE-2021-28957

lxml vulnerable to Cross-Site Scripting

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…

lxml lxml python-lxml lxml Debian Ubuntu Azure Linux Alpine PyPI

Mar 21, 2021
Medium 5.7

CVE-2021-3426

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or …

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu Azure Linux Alpine

May 20, 2021
Medium 5.7

CVE-2021-3572 Public exploit

Improper Input Validation in pip

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This i…

python-pip pip python-pip python-IPy Debian Ubuntu Azure Linux PyPI

Nov 10, 2021
Unscored —

CVE-2021-29921

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.…

python3.8 python3.9 pypy3 python3 Debian Ubuntu Alpine

May 6, 2021
Unscored —

CVE-2021-3733

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTT…

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu Azure Linux

Mar 7, 2022

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1935913
report
https://bugzilla.redhat.com/show_bug.cgi?id=1941534
report
https://bugzilla.redhat.com/show_bug.cgi?id=1957458
report
https://bugzilla.redhat.com/show_bug.cgi?id=1962856
report
https://bugzilla.redhat.com/show_bug.cgi?id=1968074
report
https://bugzilla.redhat.com/show_bug.cgi?id=1995162
report
https://bugzilla.redhat.com/show_bug.cgi?id=1995234
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4160.json
report
https://access.redhat.com/security/cve/CVE-2021-3426
advisory
https://www.cve.org/CVERecord?id=CVE-2021-3426
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3426
report
https://access.redhat.com/security/cve/CVE-2021-3572
advisory
https://www.cve.org/CVERecord?id=CVE-2021-3572
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3572
report
https://access.redhat.com/security/cve/CVE-2021-3733
advisory
https://www.cve.org/CVERecord?id=CVE-2021-3733
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3733
article
https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-14-final
article
https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-11-final
article
https://docs.python.org/3.8/whatsnew/changelog.html#python-3-8-10-final
article
https://docs.python.org/3.9/whatsnew/changelog.html#python-3-9-5-final
report
https://access.redhat.com/security/cve/CVE-2021-3737
advisory
https://www.cve.org/CVERecord?id=CVE-2021-3737
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3737
report
https://access.redhat.com/security/cve/CVE-2021-28957
advisory
https://www.cve.org/CVERecord?id=CVE-2021-28957
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-28957
report
https://access.redhat.com/security/cve/CVE-2021-29921
advisory
https://www.cve.org/CVERecord?id=CVE-2021-29921
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-29921
article
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
report
https://access.redhat.com/security/cve/CVE-2021-33503
advisory
https://www.cve.org/CVERecord?id=CVE-2021-33503
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-33503
advisory
https://github.com/advisories/GHSA-q2q7-5pp4-w6pg

Red Hat Security Advisory: python39:3.9 and python39-devel:3.9 security update

Fixed packages 102

Vulnerabilities 7

Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote at…

lxml vulnerable to Cross-Site Scripting

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or …

Improper Input Validation in pip

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.…

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTT…

References