Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 507
Alerts This Week
Warning Icon 1 507

SUSE: 2020:3865-1 Important: Python36 Denial of Service

suse
Calendar Grey December 17, 2020
Scroller Suse
SUSE Security Patch for python38 addresses severe security flaws. Rating: critical, Announcement ID: SUSE-SU-2021:1234-2.
An update that solves four vulnerabilities and has two fixes is now available

Summary

This update for python36 fixes the following issues: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen() (bsc#1155094) - CVE-2019-20916: Fixed a directory traversal in _download_http_url() (bsc#1176262). - CVE-2020-27619: Fixed an issue where the CJK codec tests call eval() on content retrieved via HTTP (bsc#1178009). - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP (bsc#1162367). - Working-around missing python-packaging dependency in python-Sphinx is not necessary anymore (bsc#1174571). - Build of python3 documentation is not independent on the version of Sphinx(bsc#1179630). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods

Topics%20covered

Topics Covered

security advisory security update important Denial of Service SUSE Linux Enterprise Python issues

References

#1155094 #1162367 #1174571 #1176262 #1178009

#1179630

Cross- CVE-2019-18348 CVE-2019-20916 CVE-2020-27619

CVE-2020-8492

Affected Products:

SUSE Linux Enterprise Server 12-SP5

https://www.suse.com/security/cve/CVE-2019-18348.html

https://www.suse.com/security/cve/CVE-2019-20916.html

https://www.suse.com/security/cve/CVE-2020-27619.html

https://www.suse.com/security/cve/CVE-2020-8492.html

https://bugzilla.suse.com/1155094

https://bugzilla.suse.com/1162367

https://bugzilla.suse.com/1174571

https://bugzilla.suse.com/1176262

https://bugzilla.suse.com/1178009

https://bugzilla.suse.com/1179630

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2020:3865-1
Rating: important

Topics%20covered

Topics Covered

security advisory security update important Denial of Service SUSE Linux Enterprise Python issues

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.