RedHat: RHSA-2019-3520:01 Moderate: python3 security and bug fix update

    Date05 Nov 2019
    CategoryRed Hat
    39
    Posted ByLinuxSecurity Advisories
    An update for python3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Moderate: python3 security and bug fix update
    Advisory ID:       RHSA-2019:3520-01
    Product:           Red Hat Enterprise Linux
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:3520
    Issue date:        2019-11-05
    CVE Names:         CVE-2019-5010 CVE-2019-9740 CVE-2019-9947 
                       CVE-2019-9948 
    =====================================================================
    
    1. Summary:
    
    An update for python3 is now available for Red Hat Enterprise Linux 8.
    
    Red Hat Product Security has rated this update as having a security impact
    of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
    gives a detailed severity rating, is available for each vulnerability from
    the CVE link(s) in the References section.
    
    2. Relevant releases/architectures:
    
    Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
    Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64
    
    3. Description:
    
    Python is an interpreted, interactive, object-oriented programming
    language, which includes modules, classes, exceptions, very high level
    dynamic data types and dynamic typing. Python supports interfaces to many
    system calls and libraries, as well as to various windowing systems.
    
    Security Fix(es):
    
    * python: NULL pointer dereference using a specially crafted X509
    certificate (CVE-2019-5010)
    
    * python: CRLF injection via the query part of the url passed to urlopen()
    (CVE-2019-9740)
    
    * python: CRLF injection via the path part of the url passed to urlopen()
    (CVE-2019-9947)
    
    * python: Undocumented local_file protocol allows remote attackers to
    bypass protection mechanisms (CVE-2019-9948)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, acknowledgments, and other related information, refer to the CVE
    page(s) listed in the References section.
    
    Additional Changes:
    
    For detailed information on changes in this release, see the Red Hat
    Enterprise Linux 8.1 Release Notes linked from the References section.
    
    4. Solution:
    
    For details on how to apply this update, which includes the changes
    described in this advisory, refer to:
    
    https://access.redhat.com/articles/11258
    
    5. Bugs fixed (https://bugzilla.redhat.com/):
    
    1634784 - python3 hard-codes annobin usage
    1639531 - test_ssl fails on ppc64le
    1665514 - python3: RPMDiff warning - manpage with .gz suffix is not really gzipped
    1666519 - CVE-2019-5010 python: NULL pointer dereference using a specially crafted X509 certificate
    1671353 - http.client doesn't support Post-Handshake Authentication (TLS 1.3)
    1688169 - CVE-2019-9740 python: CRLF injection via the query part of the url passed to urlopen()
    1695570 - CVE-2019-9948 python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms
    1695572 - CVE-2019-9947 python: CRLF injection via the path part of the url passed to urlopen()
    1701286 - Use RPM built wheels of setuptools and pip in Python's ensurepip
    1725721 - SSLContext.post_handshake_auth implicitly enables cert validation
    1731424 - hmac.HMAC() is not FIPS compliant
    1744670 - hashlib.md5 broken in FIPS mode without workaround available
    1745499 - mod_wsgi: hashlib.get_fips_mode() fails with ValueError: [PEM routines: get_name] no start line
    1745685 - Make hashlib.get_fips_mode() a private function
    1760106 - FAIL_RETURN_IN_FIPS_MODE() patch breaks mod_wsgi: ValueError: unsupported hash type blake2b
    
    6. Package List:
    
    Red Hat Enterprise Linux AppStream (v. 8):
    
    aarch64:
    platform-python-debug-3.6.8-15.1.el8.aarch64.rpm
    platform-python-devel-3.6.8-15.1.el8.aarch64.rpm
    python3-debuginfo-3.6.8-15.1.el8.aarch64.rpm
    python3-debugsource-3.6.8-15.1.el8.aarch64.rpm
    python3-idle-3.6.8-15.1.el8.aarch64.rpm
    python3-tkinter-3.6.8-15.1.el8.aarch64.rpm
    
    ppc64le:
    platform-python-debug-3.6.8-15.1.el8.ppc64le.rpm
    platform-python-devel-3.6.8-15.1.el8.ppc64le.rpm
    python3-debuginfo-3.6.8-15.1.el8.ppc64le.rpm
    python3-debugsource-3.6.8-15.1.el8.ppc64le.rpm
    python3-idle-3.6.8-15.1.el8.ppc64le.rpm
    python3-tkinter-3.6.8-15.1.el8.ppc64le.rpm
    
    s390x:
    platform-python-debug-3.6.8-15.1.el8.s390x.rpm
    platform-python-devel-3.6.8-15.1.el8.s390x.rpm
    python3-debuginfo-3.6.8-15.1.el8.s390x.rpm
    python3-debugsource-3.6.8-15.1.el8.s390x.rpm
    python3-idle-3.6.8-15.1.el8.s390x.rpm
    python3-tkinter-3.6.8-15.1.el8.s390x.rpm
    
    x86_64:
    platform-python-3.6.8-15.1.el8.i686.rpm
    platform-python-debug-3.6.8-15.1.el8.i686.rpm
    platform-python-debug-3.6.8-15.1.el8.x86_64.rpm
    platform-python-devel-3.6.8-15.1.el8.i686.rpm
    platform-python-devel-3.6.8-15.1.el8.x86_64.rpm
    python3-debuginfo-3.6.8-15.1.el8.i686.rpm
    python3-debuginfo-3.6.8-15.1.el8.x86_64.rpm
    python3-debugsource-3.6.8-15.1.el8.i686.rpm
    python3-debugsource-3.6.8-15.1.el8.x86_64.rpm
    python3-idle-3.6.8-15.1.el8.i686.rpm
    python3-idle-3.6.8-15.1.el8.x86_64.rpm
    python3-test-3.6.8-15.1.el8.i686.rpm
    python3-tkinter-3.6.8-15.1.el8.i686.rpm
    python3-tkinter-3.6.8-15.1.el8.x86_64.rpm
    
    Red Hat Enterprise Linux BaseOS (v. 8):
    
    Source:
    python3-3.6.8-15.1.el8.src.rpm
    
    aarch64:
    platform-python-3.6.8-15.1.el8.aarch64.rpm
    python3-debuginfo-3.6.8-15.1.el8.aarch64.rpm
    python3-debugsource-3.6.8-15.1.el8.aarch64.rpm
    python3-libs-3.6.8-15.1.el8.aarch64.rpm
    python3-test-3.6.8-15.1.el8.aarch64.rpm
    
    ppc64le:
    platform-python-3.6.8-15.1.el8.ppc64le.rpm
    python3-debuginfo-3.6.8-15.1.el8.ppc64le.rpm
    python3-debugsource-3.6.8-15.1.el8.ppc64le.rpm
    python3-libs-3.6.8-15.1.el8.ppc64le.rpm
    python3-test-3.6.8-15.1.el8.ppc64le.rpm
    
    s390x:
    platform-python-3.6.8-15.1.el8.s390x.rpm
    python3-debuginfo-3.6.8-15.1.el8.s390x.rpm
    python3-debugsource-3.6.8-15.1.el8.s390x.rpm
    python3-libs-3.6.8-15.1.el8.s390x.rpm
    python3-test-3.6.8-15.1.el8.s390x.rpm
    
    x86_64:
    platform-python-3.6.8-15.1.el8.x86_64.rpm
    python3-debuginfo-3.6.8-15.1.el8.i686.rpm
    python3-debuginfo-3.6.8-15.1.el8.x86_64.rpm
    python3-debugsource-3.6.8-15.1.el8.i686.rpm
    python3-debugsource-3.6.8-15.1.el8.x86_64.rpm
    python3-libs-3.6.8-15.1.el8.i686.rpm
    python3-libs-3.6.8-15.1.el8.x86_64.rpm
    python3-test-3.6.8-15.1.el8.x86_64.rpm
    
    These packages are GPG signed by Red Hat for security.  Our key and
    details on how to verify the signature are available from
    https://access.redhat.com/security/team/key/
    
    7. References:
    
    https://access.redhat.com/security/cve/CVE-2019-5010
    https://access.redhat.com/security/cve/CVE-2019-9740
    https://access.redhat.com/security/cve/CVE-2019-9947
    https://access.redhat.com/security/cve/CVE-2019-9948
    https://access.redhat.com/security/updates/classification/#moderate
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/
    
    8. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXcHqdNzjgjWX9erEAQgI6A/8C6f6HlHBMhU7fl/1SZyBCyguWi+eRa3e
    Hbr6EvE9MjnC1iWU412vNhTxJo6A8eETPe/RRa6bU0nHq+xtq4Ls8sU6272GBjV0
    h5FCm46Rrnmk5OIYKm8qE8RqmVBYcYT59w82NIqfue7ldcRXPU1/ruh05xJw9d/C
    m3SnAUnx5/Yqp5mqL7qhHh5oK5kiXqnXw5DNREA9mJl+Uh6h7R5K19J6iBR4xRvB
    tw/z8zddsMydYlcT4kegw5R+CAlGpv+P+dd6Z4YZuWEDdc1TI2zONNrnugq9b3C9
    VicBC8RqQv+V/cATHZ2nxW/D0s39vaSlrYdSf/ti3tmRudD7nAUXAK+qoKAPfw7i
    I6fqfx+eSbwOfzpa4WUEUs2CIJz6JtKCGqw56vg5CYAARcKexOp7v1UP570tbkJ+
    T3gjFAefrpwU6ua/D5Sy9lqiKdMaf+gzDbtqYKRkJWQIBlIQGq/QNPkYTVPnGPq2
    iQLMpSzlb6RVnnMsHAVCNOQQy7+tVjLGxnc4+sG1/dTyA0Zr9b9xaDwvyDPMvggl
    va6Bd31TU+w7BTFpFf8iPU1lelpSuoI7eVHHC59IuR2tbf/L+piQqwGelOgF+IhR
    3YLFVtiVpu7+eO0fABsCFNFEEcx4IGtmuLjvzrgoLfwz1aHD5Cw9SAttrwcSdKlN
    DJV1jjzKh30=
    =eGyd
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"66","type":"x","order":"1","pct":57.39,"resources":[]},{"id":"88","title":"Should be more technical","votes":"15","type":"x","order":"2","pct":13.04,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"34","type":"x","order":"3","pct":29.57,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.