Summary
This update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner fixes the following issues:
python-pip was updated to 10.0.1 (fate#324191, bsc#1065275)
Enable python3 build for:
- python-jmespath
- python-jsonschema
- python-paramiko
- python-pexpect
- python-pip
- python-ply
- python-pretend
- python-process-tests
- python-pycodestyle
- python-pyflakes
- python-pyxdg
- python-tabulate
- python-vcversioner
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| SUSE · SLES 12 SP4 Linux Enterprise Desktop 12 SP4 | python-ply | 3.4-3.3.1 |
| SUSE · SLES 12 Linux Enterprise Module for Public Cloud 12 | python-jmespath | 0.9.2-10.6.1 |
| SUSE · SLES 12 Linux Enterprise Module for Public Cloud 12 | python-jsonschema | 2.2.0-3.3.1 |
| SUSE · SLES 12 Linux Enterprise Module for Public Cloud 12 | python-paramiko | 1.18.5-2.15.1 |
| SUSE · SLES 12 Linux Enterprise Module for Public Cloud 12 | python-pip | 10.0.1-11.6.1 |
| SUSE · SLES 12 Linux Enterprise Module for Public Cloud 12 | python-ply | 3.4-3.3.1 |
| SUSE · SLES 12 SP4 Linux Enterprise Server 12 SP4 | python-ply | 3.4-3.3.1 |
| SUSE · SLES for SAP 12 SP4 Linux Enterprise Server for SAP Applications 12 SP4 | python-ply | 3.4-3.3.1 |
| SUSE · OpenStack Cloud 7 | python-pip | 10.0.1-11.6.1 |
| SUSE · OpenStack Cloud 7 | python-ply | 3.4-3.3.1 |
Vulnerabilities 3
-
Medium 6.2
pip lack of randomness in build directory
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
-
Medium 5.9CVE-2013-5123 Public exploit
Improper Authentication in pip
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
-
Medium —
Python Requests Session Fixation
The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.