Advisories ยป MGASA-2019-0318

Updated python packages fix security vulnerabilities

Publication date: 07 Nov 2019
Modification date: 10 Nov 2019
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-9740 , CVE-2019-9947 , CVE-2019-9948 , CVE-2019-10160 , CVE-2019-16056 , CVE-2019-16935

Description

Updated python and python3 packages fix security vulnerabilities:

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
controls a url parameter, as demonstrated by the first argument to
urllib.request.urlopen with \r\n followed by an HTTP header or a Redis
command (CVE-2019-9740).

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
controls a url parameter, as demonstrated by the first argument to
urllib.request.urlopen with \r\n (specifically in the path component of a
URL) followed by an HTTP header or a Redis command. This is similar to
CVE-2019-9740 query string issue (CVE-2019-9947).

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which
makes it easier for remote attackers to bypass protection mechanisms that
blacklist file: URIs, as demonstrated by triggering a 
urllib.urlopen('local_file:///etc/passwd') call (CVE-2019-9948).

A security regression of CVE-2019-9636 was discovered in python, which
still allows an attacker to exploit CVE-2019-9636 by abusing the user and
password parts of a URL. When an application parses user-supplied URLs to
store cookies, authentication credentials, or other kind of information,
it is possible for an attacker to provide specially crafted URLs to make
the application locate host-related information (e.g. cookies,
authentication data) and send them to a different host than where it
should, unlike if the URLs had been correctly parsed. The result of an
attack may vary based on the application (CVE-2019-10160).

It was discovered that Python incorrectly parsed certain email addresses.
A remote attacker could possibly use this issue to trick Python
applications into accepting email addresses that should be denied
(CVE-2019-16056).

It was discovered that the Python documentation XML-RPC server incorrectly
handled certain fields. A remote attacker could use this issue to execute
a cross-site scripting (XSS) attack (CVE-2019-16935).

References

SRPMS

7/core