RedHat: RHSA-2019-3725:01 Moderate: rh-python36-python security, bug fix,

    Date05 Nov 2019
    CategoryRed Hat
    209
    Posted ByLinuxSecurity Advisories
    An update for rh-python36-python is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Moderate: rh-python36-python security, bug fix, and enhancement update
    Advisory ID:       RHSA-2019:3725-01
    Product:           Red Hat Software Collections
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:3725
    Issue date:        2019-11-06
    CVE Names:         CVE-2018-1060 CVE-2018-1061 CVE-2018-14647 
                       CVE-2018-20406 CVE-2018-20852 CVE-2019-5010 
                       CVE-2019-9740 CVE-2019-9947 CVE-2019-16056 
    =====================================================================
    
    1. Summary:
    
    An update for rh-python36-python is now available for Red Hat Software
    Collections.
    
    Red Hat Product Security has rated this update as having a security impact
    of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
    gives a detailed severity rating, is available for each vulnerability from
    the CVE link(s) in the References section.
    
    2. Relevant releases/architectures:
    
    Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64
    Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64le, s390x, x86_64
    Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - ppc64le, s390x, x86_64
    Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - ppc64le, s390x, x86_64
    Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - ppc64le, s390x, x86_64
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64
    
    3. Description:
    
    Python is an interpreted, interactive, object-oriented programming
    language, which includes modules, classes, exceptions, very high level
    dynamic data types and dynamic typing. Python supports interfaces to many
    system calls and libraries, as well as to various windowing systems.
    
    The following packages have been upgraded to a later upstream version:
    rh-python36-python (3.6.9). (BZ#1709344)
    
    Security Fix(es):
    
    * python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK
    method in difflib (CVE-2018-1061)
    
    * python: Missing salt initialization in _elementtree.c module
    (CVE-2018-14647)
    
    * python: Cookie domain check returns incorrect results (CVE-2018-20852)
    
    * python: NULL pointer dereference using a specially crafted X509
    certificate (CVE-2019-5010)
    
    * python: CRLF injection via the query part of the url passed to urlopen()
    (CVE-2019-9740)
    
    * python: CRLF injection via the path part of the url passed to urlopen()
    (CVE-2019-9947)
    
    * python: email.utils.parseaddr wrongly parses email addresses
    (CVE-2019-16056)
    
    * python: DOS via regular expression catastrophic backtracking in apop()
    method in pop3lib (CVE-2018-1060)
    
    * python: Integer overflow in Modules/_pickle.c allows for memory
    exhaustion if serializing gigabytes of data (CVE-2018-20406)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, acknowledgments, and other related information, refer to the CVE
    page(s) listed in the References section.
    
    Bug Fix(es):
    
    * urlsplit doesn't accept a NFKD hostname with a port number (BZ#1709340)
    
    * rh-python36 cannot unpickle datetime.date objects (BZ#1749103)
    
    4. Solution:
    
    For details on how to apply this update, which includes the changes
    described in this advisory, refer to:
    
    https://access.redhat.com/articles/11258
    
    5. Bugs fixed (https://bugzilla.redhat.com/):
    
    1549191 - CVE-2018-1060 python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib
    1549192 - CVE-2018-1061 python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib
    1631822 - CVE-2018-14647 python: Missing salt initialization in _elementtree.c module
    1664509 - CVE-2018-20406 python: Integer overflow in Modules/_pickle.c allows for memory exhaustion if serializing gigabytes of data
    1666519 - CVE-2019-5010 python: NULL pointer dereference using a specially crafted X509 certificate
    1688169 - CVE-2019-9740 python: CRLF injection via the query part of the url passed to urlopen()
    1695572 - CVE-2019-9947 python: CRLF injection via the path part of the url passed to urlopen()
    1709344 - Update Python 3 to 3.6.9 [rhscl-3.3.z]
    1740347 - CVE-2018-20852 python: Cookie domain check returns incorrect results
    1749103 - rh-python36 cannot unpickle datetime.date objects [rhscl-3.3.z]
    1749839 - CVE-2019-16056 python: email.utils.parseaddr wrongly parses email addresses
    
    6. Package List:
    
    Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):
    
    Source:
    rh-python36-python-3.6.9-2.el6.src.rpm
    
    x86_64:
    rh-python36-python-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-debug-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-debuginfo-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-devel-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-libs-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-test-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-tkinter-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-tools-3.6.9-2.el6.x86_64.rpm
    
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):
    
    Source:
    rh-python36-python-3.6.9-2.el6.src.rpm
    
    x86_64:
    rh-python36-python-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-debug-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-debuginfo-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-devel-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-libs-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-test-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-tkinter-3.6.9-2.el6.x86_64.rpm
    rh-python36-python-tools-3.6.9-2.el6.x86_64.rpm
    
    Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
    
    Source:
    rh-python36-python-3.6.9-2.el7.src.rpm
    
    aarch64:
    rh-python36-python-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-debug-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-devel-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-libs-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-test-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-tools-3.6.9-2.el7.aarch64.rpm
    
    ppc64le:
    rh-python36-python-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debug-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-devel-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-libs-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-test-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tools-3.6.9-2.el7.ppc64le.rpm
    
    s390x:
    rh-python36-python-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debug-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.s390x.rpm
    rh-python36-python-devel-3.6.9-2.el7.s390x.rpm
    rh-python36-python-libs-3.6.9-2.el7.s390x.rpm
    rh-python36-python-test-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tools-3.6.9-2.el7.s390x.rpm
    
    Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
    
    Source:
    rh-python36-python-3.6.9-2.el7.src.rpm
    
    aarch64:
    rh-python36-python-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-debug-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-devel-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-libs-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-test-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.aarch64.rpm
    rh-python36-python-tools-3.6.9-2.el7.aarch64.rpm
    
    ppc64le:
    rh-python36-python-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debug-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-devel-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-libs-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-test-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tools-3.6.9-2.el7.ppc64le.rpm
    
    s390x:
    rh-python36-python-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debug-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.s390x.rpm
    rh-python36-python-devel-3.6.9-2.el7.s390x.rpm
    rh-python36-python-libs-3.6.9-2.el7.s390x.rpm
    rh-python36-python-test-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tools-3.6.9-2.el7.s390x.rpm
    
    x86_64:
    rh-python36-python-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debug-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-devel-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-libs-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-test-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tools-3.6.9-2.el7.x86_64.rpm
    
    Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5):
    
    Source:
    rh-python36-python-3.6.9-2.el7.src.rpm
    
    ppc64le:
    rh-python36-python-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debug-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-devel-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-libs-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-test-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tools-3.6.9-2.el7.ppc64le.rpm
    
    s390x:
    rh-python36-python-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debug-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.s390x.rpm
    rh-python36-python-devel-3.6.9-2.el7.s390x.rpm
    rh-python36-python-libs-3.6.9-2.el7.s390x.rpm
    rh-python36-python-test-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tools-3.6.9-2.el7.s390x.rpm
    
    x86_64:
    rh-python36-python-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debug-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-devel-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-libs-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-test-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tools-3.6.9-2.el7.x86_64.rpm
    
    Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6):
    
    Source:
    rh-python36-python-3.6.9-2.el7.src.rpm
    
    ppc64le:
    rh-python36-python-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debug-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-devel-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-libs-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-test-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tools-3.6.9-2.el7.ppc64le.rpm
    
    s390x:
    rh-python36-python-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debug-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.s390x.rpm
    rh-python36-python-devel-3.6.9-2.el7.s390x.rpm
    rh-python36-python-libs-3.6.9-2.el7.s390x.rpm
    rh-python36-python-test-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tools-3.6.9-2.el7.s390x.rpm
    
    x86_64:
    rh-python36-python-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debug-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-devel-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-libs-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-test-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tools-3.6.9-2.el7.x86_64.rpm
    
    Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7):
    
    Source:
    rh-python36-python-3.6.9-2.el7.src.rpm
    
    ppc64le:
    rh-python36-python-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debug-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-devel-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-libs-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-test-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.ppc64le.rpm
    rh-python36-python-tools-3.6.9-2.el7.ppc64le.rpm
    
    s390x:
    rh-python36-python-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debug-3.6.9-2.el7.s390x.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.s390x.rpm
    rh-python36-python-devel-3.6.9-2.el7.s390x.rpm
    rh-python36-python-libs-3.6.9-2.el7.s390x.rpm
    rh-python36-python-test-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.s390x.rpm
    rh-python36-python-tools-3.6.9-2.el7.s390x.rpm
    
    x86_64:
    rh-python36-python-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debug-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-devel-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-libs-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-test-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tools-3.6.9-2.el7.x86_64.rpm
    
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
    
    Source:
    rh-python36-python-3.6.9-2.el7.src.rpm
    
    x86_64:
    rh-python36-python-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debug-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-debuginfo-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-devel-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-libs-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-test-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tkinter-3.6.9-2.el7.x86_64.rpm
    rh-python36-python-tools-3.6.9-2.el7.x86_64.rpm
    
    These packages are GPG signed by Red Hat for security.  Our key and
    details on how to verify the signature are available from
    https://access.redhat.com/security/team/key/
    
    7. References:
    
    https://access.redhat.com/security/cve/CVE-2018-1060
    https://access.redhat.com/security/cve/CVE-2018-1061
    https://access.redhat.com/security/cve/CVE-2018-14647
    https://access.redhat.com/security/cve/CVE-2018-20406
    https://access.redhat.com/security/cve/CVE-2018-20852
    https://access.redhat.com/security/cve/CVE-2019-5010
    https://access.redhat.com/security/cve/CVE-2019-9740
    https://access.redhat.com/security/cve/CVE-2019-9947
    https://access.redhat.com/security/cve/CVE-2019-16056
    https://access.redhat.com/security/updates/classification/#moderate
    
    8. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXcKWX9zjgjWX9erEAQioQQ/6AwBwW53gzHmUrKfKW2YJGw8BaUfeMNyM
    tsHW85O9KnWTLbZ081r3HmdLdEhdlguTf+st+JTTuoJkkJ8EyhbR22dyMxMpvbWQ
    l+1EdLL3PYSbe93Ne/W/lsQCL5Z25vs3TSoqyPl5otAatIRB2UR09/XWq/2uI66p
    pd9CUz7gjqEKQQ76MlMfnGyzpPriKsjmIvHxgMWth7ut+QnggPhGguaITyX9ZWz7
    3d6bnyMXqXB7QUQwCNkiuGiS8zIx4X4gaQNAMHl8mJj/fZiC3o5Q99EumiB37N/O
    eKf7ALWJgHfe2NXUhSRPU85khdSK5BCPp9M8z/u+KYvY1AqpOkuveQF9V0/hgi8o
    fHyEDXiOjZ5D14ij/DwJYjO9i9V3n5n7ok1TYCB4uts31E1zMALRRW0Ui24YZIPW
    OD0hpl3D5VkJDwBs9weCuSuM3RGcDQThM9Uwxry5mG3kw7fbPaJh3tntApIuMQpG
    NroMfcRbf0pHB6XZSdauK4bUEboJVA2LO9WGtRZA4svxLr9VU+eHvfX8DvYleJGD
    SnA0PJTpSezFf2zUFnDAz2e+K8JoiRzE+qqEqAdqnw3TUIa1pVdesyBk41EZdkFa
    t5lJMj2TIu3ivzk/cs+yNctiMakSGiUxge9JPpG8fw42crGydIGuQE66jtyV8BfM
    Rys+SEBMtCs=
    =IpfW
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"64","type":"x","order":"1","pct":57.14,"resources":[]},{"id":"88","title":"Should be more technical","votes":"15","type":"x","order":"2","pct":13.39,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"33","type":"x","order":"3","pct":29.46,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.