SUSE-SU-2020:3765-1

Опубликовано: 11 дек. 2020

Источник: suse-cvrf

Описание

Security update for python

This update for python fixes the following issues:

Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

Список пакетов

HPE Helion OpenStack 8

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP4-EC2-HVM-BYOS

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP4-GCE-BYOS

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP4-OCI-BYOS

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP4-SAP-Azure

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP4-SAP-EC2-HVM

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP4-SAP-EC2-HVM-BYOS

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP4-SAP-GCE

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP4-SAP-GCE-BYOS

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP4-SAP-OCI-BYOS

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP5-OCI-BYOS-BYOS

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Image SLES12-SP5-OCI-BYOS-SAP-BYOS

libpython2_7-1_0-2.7.17-28.59.1

python-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Enterprise Storage 5

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-strict-tls-check-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server 12 SP2-BCL

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server 12 SP2-LTSS

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server 12 SP3-BCL

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server 12 SP3-LTSS

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server 12 SP4-LTSS

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server 12 SP5

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server for SAP Applications 12 SP2

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server for SAP Applications 12 SP3

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server for SAP Applications 12 SP4

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Server for SAP Applications 12 SP5

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE Linux Enterprise Workstation Extension 12 SP5

python-devel-2.7.17-28.59.1

SUSE OpenStack Cloud 7

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE OpenStack Cloud 8

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE OpenStack Cloud 9

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE OpenStack Cloud Crowbar 8

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

SUSE OpenStack Cloud Crowbar 9

libpython2_7-1_0-2.7.17-28.59.1

libpython2_7-1_0-32bit-2.7.17-28.59.1

python-2.7.17-28.59.1

python-32bit-2.7.17-28.59.1

python-base-2.7.17-28.59.1

python-base-32bit-2.7.17-28.59.1

python-curses-2.7.17-28.59.1

python-demo-2.7.17-28.59.1

python-devel-2.7.17-28.59.1

python-doc-2.7.17-28.59.1

python-doc-pdf-2.7.17-28.59.1

python-gdbm-2.7.17-28.59.1

python-idle-2.7.17-28.59.1

python-tk-2.7.17-28.59.1

python-xml-2.7.17-28.59.1

Ссылки

https://www.suse.com/support/update/announcement/2020/suse-su-20203765-1/
Link for SUSE-SU-2020:3765-1
https://lists.suse.com/pipermail/sle-security-updates/2020-December/007975.html
E-Mail link for SUSE-SU-2020:3765-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1176262
SUSE Bug 1176262
https://www.suse.com/security/cve/CVE-2019-20916/
SUSE CVE CVE-2019-20916 page

Описание

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Затронутые продукты

HPE Helion OpenStack 8:libpython2_7-1_0-2.7.17-28.59.1

HPE Helion OpenStack 8:libpython2_7-1_0-32bit-2.7.17-28.59.1

HPE Helion OpenStack 8:python-2.7.17-28.59.1

HPE Helion OpenStack 8:python-32bit-2.7.17-28.59.1

Ссылки

https://www.suse.com/security/cve/CVE-2019-20916.html
CVE-2019-20916
https://bugzilla.suse.com/1176262
SUSE Bug 1176262

SUSE-SU-2020:3765-1

Описание

Список пакетов

HPE Helion OpenStack 8

Image SLES12-SP4-EC2-HVM-BYOS

Image SLES12-SP4-GCE-BYOS

Image SLES12-SP4-OCI-BYOS

Image SLES12-SP4-SAP-Azure

Image SLES12-SP4-SAP-EC2-HVM

Image SLES12-SP4-SAP-EC2-HVM-BYOS

Image SLES12-SP4-SAP-GCE

Image SLES12-SP4-SAP-GCE-BYOS

Image SLES12-SP4-SAP-OCI-BYOS

Image SLES12-SP5-OCI-BYOS-BYOS

Image SLES12-SP5-OCI-BYOS-SAP-BYOS

SUSE Enterprise Storage 5

SUSE Linux Enterprise Server 12 SP2-BCL

SUSE Linux Enterprise Server 12 SP2-LTSS

SUSE Linux Enterprise Server 12 SP3-BCL

SUSE Linux Enterprise Server 12 SP3-LTSS

SUSE Linux Enterprise Server 12 SP4-LTSS

SUSE Linux Enterprise Server 12 SP5

SUSE Linux Enterprise Server for SAP Applications 12 SP2

SUSE Linux Enterprise Server for SAP Applications 12 SP3

SUSE Linux Enterprise Server for SAP Applications 12 SP4

SUSE Linux Enterprise Server for SAP Applications 12 SP5

SUSE Linux Enterprise Workstation Extension 12 SP5

SUSE OpenStack Cloud 7

SUSE OpenStack Cloud 8

SUSE OpenStack Cloud 9

SUSE OpenStack Cloud Crowbar 8

SUSE OpenStack Cloud Crowbar 9

Ссылки

Уязвимость: CVE-2019-20916

Описание

Затронутые продукты

Ссылки