Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:14550-1

Опубликовано: 26 нояб. 2020
Источник: suse-cvrf

Описание

Security update for python

This update for python fixes the following issues:

  • bsc#1177211 (CVE-2020-26116) no longer allowing special characters in the method parameter of HTTPConnection.putrequest in httplib, stopping injection of headers.

Список пакетов

SUSE Linux Enterprise Point of Sale 11 SP3
libpython2_6-1_0-2.6.9-40.48.1
python-2.6.9-40.48.1
python-base-2.6.9-40.48.1
python-curses-2.6.9-40.48.1
python-demo-2.6.9-40.48.1
python-doc-2.6-8.40.48.1
python-doc-pdf-2.6-8.40.48.1
python-gdbm-2.6.9-40.48.1
python-idle-2.6.9-40.48.1
python-tk-2.6.9-40.48.1
python-xml-2.6.9-40.48.1
SUSE Linux Enterprise Server 11 SP4-LTSS
libpython2_6-1_0-2.6.9-40.48.1
libpython2_6-1_0-32bit-2.6.9-40.48.1
python-2.6.9-40.48.1
python-32bit-2.6.9-40.48.1
python-base-2.6.9-40.48.1
python-base-32bit-2.6.9-40.48.1
python-curses-2.6.9-40.48.1
python-demo-2.6.9-40.48.1
python-doc-2.6-8.40.48.1
python-doc-pdf-2.6-8.40.48.1
python-gdbm-2.6.9-40.48.1
python-idle-2.6.9-40.48.1
python-tk-2.6.9-40.48.1
python-xml-2.6.9-40.48.1

Ссылки

Описание

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:libpython2_6-1_0-2.6.9-40.48.1
SUSE Linux Enterprise Point of Sale 11 SP3:python-2.6.9-40.48.1
SUSE Linux Enterprise Point of Sale 11 SP3:python-base-2.6.9-40.48.1
SUSE Linux Enterprise Point of Sale 11 SP3:python-curses-2.6.9-40.48.1
Ссылки