SUSE-SU-2020:0854-1

Опубликовано: 02 апр. 2020

Источник: suse-cvrf

Описание

Security update for python3

This update for python3 fixes the following issue:

CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094).
CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825).
CVE-2020-8492: Fixed a regular expression in urllib that was prone to denial of service via HTTP (bsc#1162367).
Fixed an issue with version missmatch (bsc#1162224).
Rename idle icons to idle3 in order to not conflict with python2 variant of the package. (bsc#1165894)

Список пакетов

HPE Helion OpenStack 8

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

Image SLES12-SP4-Azure-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP4-EC2-HVM-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP4-GCE-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP4-OCI-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP4-SAP-Azure

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP4-SAP-Azure-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP4-SAP-Azure-LI-BYOS-Production

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP4-SAP-EC2-HVM

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP4-SAP-EC2-HVM-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP4-SAP-GCE

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP4-SAP-GCE-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP4-SAP-OCI-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP5-Azure-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-Azure-Basic-On-Demand

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-Azure-HPC-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-Azure-HPC-On-Demand

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-Azure-SAP-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP5-Azure-SAP-On-Demand

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP5-Azure-Standard-On-Demand

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-EC2-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-EC2-ECS-On-Demand

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-EC2-On-Demand

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-EC2-SAP-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP5-EC2-SAP-On-Demand

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP5-GCE-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-GCE-On-Demand

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-GCE-SAP-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP5-GCE-SAP-On-Demand

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP5-OCI-BYOS-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

Image SLES12-SP5-OCI-BYOS-SAP-BYOS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP5-SAP-Azure-LI-BYOS-Production

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

SUSE Enterprise Storage 5

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE Linux Enterprise Module for Web and Scripting 12

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

SUSE Linux Enterprise Server 12 SP1-LTSS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE Linux Enterprise Server 12 SP2-BCL

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

SUSE Linux Enterprise Server 12 SP2-LTSS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE Linux Enterprise Server 12 SP3-BCL

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

SUSE Linux Enterprise Server 12 SP3-LTSS

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE Linux Enterprise Server 12 SP4

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

SUSE Linux Enterprise Server 12 SP5

libpython3_4m1_0-3.4.10-25.45.1

libpython3_4m1_0-32bit-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-tk-3.4.10-25.45.1

SUSE Linux Enterprise Server for SAP Applications 12 SP1

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE Linux Enterprise Server for SAP Applications 12 SP2

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE Linux Enterprise Server for SAP Applications 12 SP3

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE Linux Enterprise Server for SAP Applications 12 SP4

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

SUSE Linux Enterprise Server for SAP Applications 12 SP5

libpython3_4m1_0-3.4.10-25.45.1

libpython3_4m1_0-32bit-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-tk-3.4.10-25.45.1

SUSE Linux Enterprise Software Development Kit 12 SP4

python3-dbm-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE Linux Enterprise Software Development Kit 12 SP5

python3-dbm-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE OpenStack Cloud 7

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE OpenStack Cloud 8

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

SUSE OpenStack Cloud Crowbar 8

libpython3_4m1_0-3.4.10-25.45.1

python3-3.4.10-25.45.1

python3-base-3.4.10-25.45.1

python3-curses-3.4.10-25.45.1

python3-devel-3.4.10-25.45.1

Ссылки

https://www.suse.com/support/update/announcement/2020/suse-su-20200854-1/
Link for SUSE-SU-2020:0854-1
https://lists.suse.com/pipermail/sle-security-updates/2020-April/006666.html
E-Mail link for SUSE-SU-2020:0854-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1155094
SUSE Bug 1155094
https://bugzilla.suse.com/1162224
SUSE Bug 1162224
https://bugzilla.suse.com/1162367
SUSE Bug 1162367
https://bugzilla.suse.com/1162825
SUSE Bug 1162825
https://bugzilla.suse.com/1165894
SUSE Bug 1165894
https://www.suse.com/security/cve/CVE-2019-18348/
SUSE CVE CVE-2019-18348 page
https://www.suse.com/security/cve/CVE-2019-9674/
SUSE CVE CVE-2019-9674 page
https://www.suse.com/security/cve/CVE-2020-8492/
SUSE CVE CVE-2020-8492 page

Описание

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

Затронутые продукты

HPE Helion OpenStack 8:libpython3_4m1_0-3.4.10-25.45.1

HPE Helion OpenStack 8:python3-3.4.10-25.45.1

HPE Helion OpenStack 8:python3-base-3.4.10-25.45.1

HPE Helion OpenStack 8:python3-curses-3.4.10-25.45.1

Ссылки

https://www.suse.com/security/cve/CVE-2019-18348.html
CVE-2019-18348
https://bugzilla.suse.com/1155094
SUSE Bug 1155094

Описание

Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

Затронутые продукты

HPE Helion OpenStack 8:libpython3_4m1_0-3.4.10-25.45.1

HPE Helion OpenStack 8:python3-3.4.10-25.45.1

HPE Helion OpenStack 8:python3-base-3.4.10-25.45.1

HPE Helion OpenStack 8:python3-curses-3.4.10-25.45.1

Ссылки

https://www.suse.com/security/cve/CVE-2019-9674.html
CVE-2019-9674
https://bugzilla.suse.com/1162825
SUSE Bug 1162825

Описание

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Затронутые продукты

HPE Helion OpenStack 8:libpython3_4m1_0-3.4.10-25.45.1

HPE Helion OpenStack 8:python3-3.4.10-25.45.1

HPE Helion OpenStack 8:python3-base-3.4.10-25.45.1

HPE Helion OpenStack 8:python3-curses-3.4.10-25.45.1

Ссылки

https://www.suse.com/security/cve/CVE-2020-8492.html
CVE-2020-8492
https://bugzilla.suse.com/1162367
SUSE Bug 1162367

SUSE-SU-2020:0854-1

Описание

Список пакетов

HPE Helion OpenStack 8

Image SLES12-SP4-Azure-BYOS

Image SLES12-SP4-EC2-HVM-BYOS

Image SLES12-SP4-GCE-BYOS

Image SLES12-SP4-OCI-BYOS

Image SLES12-SP4-SAP-Azure

Image SLES12-SP4-SAP-Azure-BYOS

Image SLES12-SP4-SAP-Azure-LI-BYOS-Production

Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production

Image SLES12-SP4-SAP-EC2-HVM

Image SLES12-SP4-SAP-EC2-HVM-BYOS

Image SLES12-SP4-SAP-GCE

Image SLES12-SP4-SAP-GCE-BYOS

Image SLES12-SP4-SAP-OCI-BYOS

Image SLES12-SP5-Azure-BYOS

Image SLES12-SP5-Azure-Basic-On-Demand

Image SLES12-SP5-Azure-HPC-BYOS

Image SLES12-SP5-Azure-HPC-On-Demand

Image SLES12-SP5-Azure-SAP-BYOS

Image SLES12-SP5-Azure-SAP-On-Demand

Image SLES12-SP5-Azure-Standard-On-Demand

Image SLES12-SP5-EC2-BYOS

Image SLES12-SP5-EC2-ECS-On-Demand

Image SLES12-SP5-EC2-On-Demand

Image SLES12-SP5-EC2-SAP-BYOS

Image SLES12-SP5-EC2-SAP-On-Demand

Image SLES12-SP5-GCE-BYOS

Image SLES12-SP5-GCE-On-Demand

Image SLES12-SP5-GCE-SAP-BYOS

Image SLES12-SP5-GCE-SAP-On-Demand

Image SLES12-SP5-OCI-BYOS-BYOS

Image SLES12-SP5-OCI-BYOS-SAP-BYOS

Image SLES12-SP5-SAP-Azure-LI-BYOS-Production

Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production

SUSE Enterprise Storage 5

SUSE Linux Enterprise Module for Web and Scripting 12

SUSE Linux Enterprise Server 12 SP1-LTSS

SUSE Linux Enterprise Server 12 SP2-BCL

SUSE Linux Enterprise Server 12 SP2-LTSS

SUSE Linux Enterprise Server 12 SP3-BCL

SUSE Linux Enterprise Server 12 SP3-LTSS

SUSE Linux Enterprise Server 12 SP4

SUSE Linux Enterprise Server 12 SP5

SUSE Linux Enterprise Server for SAP Applications 12 SP1

SUSE Linux Enterprise Server for SAP Applications 12 SP2

SUSE Linux Enterprise Server for SAP Applications 12 SP3

SUSE Linux Enterprise Server for SAP Applications 12 SP4

SUSE Linux Enterprise Server for SAP Applications 12 SP5

SUSE Linux Enterprise Software Development Kit 12 SP4

SUSE Linux Enterprise Software Development Kit 12 SP5

SUSE OpenStack Cloud 7

SUSE OpenStack Cloud 8

SUSE OpenStack Cloud Crowbar 8

Ссылки

Уязвимость: CVE-2019-18348

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2019-9674

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2020-8492

Описание

Затронутые продукты

Ссылки