Red Hat Security Advisory: rh-python38-python security update

Fixed packages 10

Vulnerabilities 3

• High 7.8
  CVE-2015-20107 Public exploit

  In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux Alpine
  Apr 13, 2022
• Medium 6.5
  CVE-2021-28861

  Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multip…

  python3.5 python3.9 python3 python3.10 Debian Ubuntu Azure Linux
  Aug 23, 2022
• Medium 6.2
  CVE-2020-10735

  A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text")…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Wolfi
  Sep 9, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1834423
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2075390
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2120642
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6766.json
• report
  https://access.redhat.com/security/cve/CVE-2015-20107
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-20107
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-20107
• article
  https://python-security.readthedocs.io/vuln/mailcap-shell-injection.html
• report
  https://access.redhat.com/security/cve/CVE-2020-10735
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-10735
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-10735
• article
  https://github.com/python/cpython/pull/96499
• report
  https://access.redhat.com/security/cve/CVE-2021-28861
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-28861
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-28861