RHSA-2021:4162 — Red Hat Security Advisory: python38:3.8 and python38-devel:3.8 security update

Fixed packages 109

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	babel	0:2.7.0-11.module+el8.5.0+11015+9c1c7c42
Red Hat · RHEL 8 enterprise_linux:8::appstream	Cython	0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	Cython-debugsource	0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_wsgi	0:4.6.8-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy	0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	numpy-debugsource	0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-asn1crypto	0:1.2.0-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cffi	0:1.13.2-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cffi-debugsource	0:1.13.2-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-chardet	0:3.0.4-19.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cryptography	0:2.8-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-cryptography-debugsource	0:2.8-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-idna	0:2.8-6.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-jinja2	0:2.10.3-5.module+el8.5.0+10542+ba057329
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml	0:4.4.1-6.module+el8.5.0+10542+ba057329
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-lxml-debugsource	0:4.4.1-6.module+el8.5.0+10542+ba057329
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-markupsafe	0:1.1.1-6.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-markupsafe-debugsource	0:1.1.1-6.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-ply	0:3.11-10.module+el8.4.0+9579+e9717e18
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psutil	0:5.6.4-4.module+el8.5.0+12031+10ce4870
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psutil-debugsource	0:5.6.4-4.module+el8.5.0+12031+10ce4870
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2	0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-psycopg2-debugsource	0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pycparser	0:2.19-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-PyMySQL	0:0.10.1-1.module+el8.4.0+9692+8e86ab84
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-pysocks	0:1.7.1-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-requests	0:2.22.0-9.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-urllib3	0:1.25.7-5.module+el8.5.0+11639+ea5b349d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-wheel	0:0.33.6-6.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-asn1crypto	0:1.2.0-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-babel	0:2.7.0-11.module+el8.5.0+11015+9c1c7c42
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-cffi	0:1.13.2-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-cffi-debuginfo	0:1.13.2-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-chardet	0:3.0.4-19.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-cryptography	0:2.8-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-cryptography-debuginfo	0:2.8-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-Cython	0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-Cython-debuginfo	0:0.29.14-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-debug	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-debuginfo	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-debugsource	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-devel	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-idle	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-idna	0:2.8-6.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-jinja2	0:2.10.3-5.module+el8.5.0+10542+ba057329
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-libs	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-lxml	0:4.4.1-6.module+el8.5.0+10542+ba057329
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-lxml-debuginfo	0:4.4.1-6.module+el8.5.0+10542+ba057329
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-markupsafe	0:1.1.1-6.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-markupsafe-debuginfo	0:1.1.1-6.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-mod_wsgi	0:4.6.8-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-numpy	0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-numpy-debuginfo	0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-numpy-doc	0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-numpy-f2py	0:1.17.3-6.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pip	0:19.3.1-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pip-wheel	0:19.3.1-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-ply	0:3.11-10.module+el8.4.0+9579+e9717e18
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psutil	0:5.6.4-4.module+el8.5.0+12031+10ce4870
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psutil-debuginfo	0:5.6.4-4.module+el8.5.0+12031+10ce4870
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psycopg2	0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psycopg2-debuginfo	0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psycopg2-doc	0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-psycopg2-tests	0:2.8.4-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pycparser	0:2.19-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-PyMySQL	0:0.10.1-1.module+el8.4.0+9692+8e86ab84
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pysocks	0:1.7.1-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pytz	0:2019.3-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pyyaml	0:5.4.1-1.module+el8.5.0+10721+14d8e0d5
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-pyyaml-debuginfo	0:5.4.1-1.module+el8.5.0+10721+14d8e0d5
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-requests	0:2.22.0-9.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-rpm-macros	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-scipy	0:1.3.1-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-scipy-debuginfo	0:1.3.1-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-setuptools	0:41.6.0-5.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-setuptools-wheel	0:41.6.0-5.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-six	0:1.12.0-10.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-test	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-tkinter	0:3.8.8-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-urllib3	0:1.25.7-5.module+el8.5.0+11639+ea5b349d
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-wheel	0:0.33.6-6.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python38-wheel-wheel	0:0.33.6-6.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-pip	0:19.3.1-4.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-setuptools	0:41.6.0-5.module+el8.5.0+12205+a865257a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3x-six	0:1.12.0-10.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	pytz	0:2019.3-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML	0:5.4.1-1.module+el8.5.0+10721+14d8e0d5
Red Hat · RHEL 8 enterprise_linux:8::appstream	PyYAML-debugsource	0:5.4.1-1.module+el8.5.0+10721+14d8e0d5
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy	0:1.3.1-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::appstream	scipy-debugsource	0:1.3.1-4.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	pytest	0:4.6.6-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python-atomicwrites	0:1.3.0-8.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python-attrs	0:19.3.0-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python-more-itertools	0:7.2.0-5.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python-packaging	0:19.2-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python-pluggy	0:0.13.0-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python-py	0:1.8.0-8.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python-wcwidth	0:0.1.7-16.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python38-atomicwrites	0:1.3.0-8.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python38-attrs	0:19.3.0-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python38-more-itertools	0:7.2.0-5.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python38-packaging	0:19.2-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python38-pluggy	0:0.13.0-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python38-py	0:1.8.0-8.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python38-pyparsing	0:2.4.5-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python38-pytest	0:4.6.6-3.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python38-wcwidth	0:0.1.7-16.module+el8.4.0+8888+89bc7e79
Red Hat · RHEL 8 enterprise_linux:8::crb	python3x-pyparsing	0:2.4.5-3.module+el8.4.0+8888+89bc7e79

Vulnerabilities 11

High 7.8

CVE-2021-42771

Directory Traversal in Babel

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

babel babel py3-babel python-babel Debian Azure Linux Alpine PyPI

Oct 20, 2021
High 7.5

CVE-2019-18874

Double Free in psutil

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

py3-psutil python-psutil python-psutil psutil Debian Ubuntu Azure Linux Alpine PyPI

Nov 12, 2019
High 7.5

CVE-2021-33503

Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a para…

python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu Azure Linux PyPI

Jun 29, 2021
Medium 6.1

CVE-2021-28957

lxml vulnerable to Cross-Site Scripting

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…

lxml lxml python-lxml lxml Debian Ubuntu Azure Linux Alpine PyPI

Mar 21, 2021
Medium 5.9

CVE-2021-23336 EPSS 41%

Web Cache Poisoning

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called par…

python-django python-django python3.4 python3.5 Debian Ubuntu Azure Linux Alpine

Feb 15, 2021
Medium 5.7

CVE-2021-3426

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or …

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu Azure Linux Alpine

May 20, 2021
Medium 5.7

CVE-2021-3572 Public exploit

Improper Input Validation in pip

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This i…

python-pip pip python-pip python-IPy Debian Ubuntu Azure Linux PyPI

Nov 10, 2021
Medium 5.3

CVE-2020-28493

Regular Expression Denial of Service (ReDoS)

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. T…

nodejs nodejs24 jinja2 jinja2 Debian Ubuntu Azure Linux Alpine PyPI

Feb 1, 2021
Unscored —

CVE-2020-27619

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via …

python3.4 python3.5 python3.6 python3.8 Debian Ubuntu

Oct 22, 2020
Unscored —

CVE-2021-20095 Rejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

python-babel Ubuntu

Apr 29, 2021
Unscored —

CVE-2021-29921

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.…

python3.8 python3.9 pypy3 python3 Debian Ubuntu Alpine

May 6, 2021

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1772014
report
https://bugzilla.redhat.com/show_bug.cgi?id=1928707
report
https://bugzilla.redhat.com/show_bug.cgi?id=1928904
report
https://bugzilla.redhat.com/show_bug.cgi?id=1935913
report
https://bugzilla.redhat.com/show_bug.cgi?id=1941534
report
https://bugzilla.redhat.com/show_bug.cgi?id=1955615
report
https://bugzilla.redhat.com/show_bug.cgi?id=1957458
report
https://bugzilla.redhat.com/show_bug.cgi?id=1962856
report
https://bugzilla.redhat.com/show_bug.cgi?id=1968074
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4162.json
report
https://access.redhat.com/security/cve/CVE-2019-18874
advisory
https://www.cve.org/CVERecord?id=CVE-2019-18874
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-18874
report
https://access.redhat.com/security/cve/CVE-2020-27619
report
https://bugzilla.redhat.com/show_bug.cgi?id=1889886
advisory
https://www.cve.org/CVERecord?id=CVE-2020-27619
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-27619
report
https://access.redhat.com/security/cve/CVE-2020-28493
advisory
https://www.cve.org/CVERecord?id=CVE-2020-28493
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-28493
report
https://access.redhat.com/security/cve/CVE-2021-3426
advisory
https://www.cve.org/CVERecord?id=CVE-2021-3426
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3426
report
https://access.redhat.com/security/cve/CVE-2021-3572
advisory
https://www.cve.org/CVERecord?id=CVE-2021-3572
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-3572
report
https://access.redhat.com/security/cve/CVE-2021-20095
advisory
https://www.cve.org/CVERecord?id=CVE-2021-20095
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-20095
article
https://www.tenable.com/security/research/tra-2021-14
report
https://access.redhat.com/security/cve/CVE-2021-23336
advisory
https://www.cve.org/CVERecord?id=CVE-2021-23336
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-23336
article
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
report
https://access.redhat.com/security/cve/CVE-2021-28957
advisory
https://www.cve.org/CVERecord?id=CVE-2021-28957
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-28957

Red Hat Security Advisory: python38:3.8 and python38-devel:3.8 security update

Fixed packages 109

Vulnerabilities 11

Directory Traversal in Babel

Double Free in psutil

Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

lxml vulnerable to Cross-Site Scripting

Web Cache Poisoning

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or …

Improper Input Validation in pip

Regular Expression Denial of Service (ReDoS)

In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via …

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.…

References