Updated python packages fix security vulnerabilities
Publication date: 07 Nov 2019Modification date: 10 Nov 2019
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-9740 , CVE-2019-9947 , CVE-2019-9948 , CVE-2019-10160 , CVE-2019-16056 , CVE-2019-16935
Description
Updated python and python3 packages fix security vulnerabilities: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n followed by an HTTP header or a Redis command (CVE-2019-9740). An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL) followed by an HTTP header or a Redis command. This is similar to CVE-2019-9740 query string issue (CVE-2019-9947). urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call (CVE-2019-9948). A security regression of CVE-2019-9636 was discovered in python, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application (CVE-2019-10160). It was discovered that Python incorrectly parsed certain email addresses. A remote attacker could possibly use this issue to trick Python applications into accepting email addresses that should be denied (CVE-2019-16056). It was discovered that the Python documentation XML-RPC server incorrectly handled certain fields. A remote attacker could use this issue to execute a cross-site scripting (XSS) attack (CVE-2019-16935).
References
- https://bugs.mageia.org/show_bug.cgi?id=25641
- https://access.redhat.com/errata/RHSA-2019:1587
- https://access.redhat.com/errata/RHSA-2019:2030
- https://access.redhat.com/errata/RHSA-2019:3520
- https://usn.ubuntu.com/4151-1/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9947
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9948
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10160
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16935
SRPMS
7/core
- python-2.7.17-1.1.mga7
- python3-3.7.5-1.mga7