MGASA-2021-0165 - Updated python and python3 packages fix security vulnerability

Publication date: 02 Apr 2021
URL: https://advisories.mageia.org/MGASA-2021-0165.html
Type: security
Affected Mageia releases: 7, 8
CVE: CVE-2021-23336

Updated python and python3  security vulnerability:

The package python/cpython is vulnerable to Web Cache Poisoning via
urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called
parameter cloaking. When the attacker can separate query parameters using
a semicolon (;), they can cause a difference in the interpretation of the
request between the proxy (running with default configuration) and the
server. This can result in malicious requests being cached as completely
safe ones, as the proxy  would usually not see the semicolon as a separator,
and therefore would not include it in a cache key of an unkeyed parameter
(CVE-2021-23336).

References:
- https://bugs.mageia.org/show_bug.cgi?id=28408
- https://blog.python.org/2021/02/python-392-and-388-are-now-available.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336

SRPMS:
- 7/core/python3-3.7.10-1.mga7
- 7/core/python-2.7.18-1.3.mga7
- 8/core/python3-3.8.8-1.mga8
- 8/core/python-2.7.18-7.1.mga8