Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-RU-2020:0775-1

Опубликовано: 24 мар. 2020
Источник: suse-cvrf

Описание

Recommended update for python-botocore

This update for python-boto3, python-botocore and python-futures fixes the following issues:

python-botocore was updated to 1.13.33:

  • Fix for python3-botocore versioning issues between SLES12 SP3 Teradata and Public Cloud Module. (bsc#1129696)
  • Remove the broken attempt to avoid using the bundled requests module provided by the source. (boo#1088310)
  • Update to the latest SDK components. (bsc#1146853, bsc#1146854)
  • Add support for urllib 1.25 for CVE-2019-9947. (boo#1136184)
  • Fix implementing MD5 header injection into new operations if they are necessary and create default session configuration. (bsc#1118021, bsc#1118024, bsc#1118027)
  • Add attribute 'ssl_context' to 'AWSHTTPSConnection'. (bsc#1095041)

python-boto3 was updated to 1.10.33.

python-futures also provides python2-futures in the python2 build.

Список пакетов

HPE Helion OpenStack 8
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
Image SLES12-SP4-Azure-BYOS
python-futures-3.0.2-15.3.1
Image SLES12-SP4-EC2-HVM-BYOS
python-boto3-1.10.33-14.14.1
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
python-s3transfer-0.2.1-8.7.1
Image SLES12-SP4-GCE-BYOS
python-futures-3.0.2-15.3.1
Image SLES12-SP4-SAP-Azure-BYOS
python-futures-3.0.2-15.3.1
Image SLES12-SP4-SAP-EC2-HVM
python-boto3-1.10.33-14.14.1
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
python-s3transfer-0.2.1-8.7.1
Image SLES12-SP4-SAP-EC2-HVM-BYOS
python-boto3-1.10.33-14.14.1
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
python-s3transfer-0.2.1-8.7.1
Image SLES12-SP4-SAP-GCE-BYOS
python-futures-3.0.2-15.3.1
Image SLES12-SP5-Azure-BYOS
python-futures-3.0.2-15.3.1
Image SLES12-SP5-Azure-HPC-BYOS
python-futures-3.0.2-15.3.1
Image SLES12-SP5-Azure-SAP-BYOS
python-futures-3.0.2-15.3.1
Image SLES12-SP5-EC2-BYOS
python-boto3-1.10.33-14.14.1
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
python-s3transfer-0.2.1-8.7.1
Image SLES12-SP5-EC2-ECS-On-Demand
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
python-s3transfer-0.2.1-8.7.1
Image SLES12-SP5-EC2-On-Demand
python-boto3-1.10.33-14.14.1
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
python-s3transfer-0.2.1-8.7.1
Image SLES12-SP5-EC2-SAP-BYOS
python-boto3-1.10.33-14.14.1
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
python-s3transfer-0.2.1-8.7.1
Image SLES12-SP5-EC2-SAP-On-Demand
python-boto3-1.10.33-14.14.1
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
python-s3transfer-0.2.1-8.7.1
Image SLES12-SP5-GCE-BYOS
python-futures-3.0.2-15.3.1
Image SLES12-SP5-GCE-SAP-BYOS
python-futures-3.0.2-15.3.1
SUSE Enterprise Storage 5
python-futures-3.0.2-15.3.1
SUSE Linux Enterprise Module for Advanced Systems Management 12
python-futures-3.0.2-15.3.1
SUSE Linux Enterprise Module for Public Cloud 12
python-boto3-1.10.33-14.14.1
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
python-s3transfer-0.2.1-8.7.1
python3-boto3-1.10.33-14.14.1
python3-botocore-1.13.33-28.20.1
python3-s3transfer-0.2.1-8.7.1
SUSE Linux Enterprise Point of Sale 12 SP2
python-futures-3.0.2-15.3.1
SUSE Manager Client Tools 12
python-futures-3.0.2-15.3.1
SUSE Manager Proxy 3.2
python-futures-3.0.2-15.3.1
SUSE Manager Server 3.2
python-futures-3.0.2-15.3.1
SUSE OpenStack Cloud 7
python-futures-3.0.2-15.3.1
SUSE OpenStack Cloud 8
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1
SUSE OpenStack Cloud Crowbar 8
python-botocore-1.13.33-28.20.1
python-futures-3.0.2-15.3.1

Ссылки

Описание

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Затронутые продукты
HPE Helion OpenStack 8:python-botocore-1.13.33-28.20.1
HPE Helion OpenStack 8:python-futures-3.0.2-15.3.1
Image SLES12-SP4-Azure-BYOS:python-futures-3.0.2-15.3.1
Image SLES12-SP4-EC2-HVM-BYOS:python-boto3-1.10.33-14.14.1
Ссылки
Уязвимость SUSE-RU-2020:0775-1