SUSE-SU-2021:0886-1

Опубликовано: 19 мар. 2021

Источник: suse-cvrf

Описание

Security update for python3

This update for python3 fixes the following issues:

CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator (bsc#1182379).

Список пакетов

Image SLES12-SP4-Azure-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP4-EC2-HVM-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP4-GCE-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP4-SAP-Azure

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP4-SAP-Azure-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP4-SAP-Azure-LI-BYOS-Production

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP4-SAP-EC2-HVM

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP4-SAP-EC2-HVM-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP4-SAP-GCE

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP4-SAP-GCE-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP5-Azure-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-Azure-Basic-On-Demand

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-Azure-HPC-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-Azure-HPC-On-Demand

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-Azure-SAP-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP5-Azure-SAP-On-Demand

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP5-Azure-Standard-On-Demand

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-EC2-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-EC2-ECS-On-Demand

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-EC2-On-Demand

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-EC2-SAP-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP5-EC2-SAP-On-Demand

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP5-GCE-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-GCE-On-Demand

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-GCE-SAP-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP5-GCE-SAP-On-Demand

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP5-OCI-BYOS-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

Image SLES12-SP5-OCI-BYOS-SAP-BYOS

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP5-SAP-Azure-LI-BYOS-Production

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

SUSE Linux Enterprise Module for Web and Scripting 12

libpython3_4m1_0-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

SUSE Linux Enterprise Server 12 SP5

libpython3_4m1_0-3.4.10-25.66.1

libpython3_4m1_0-32bit-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

python3-devel-3.4.10-25.66.1

python3-tk-3.4.10-25.66.1

SUSE Linux Enterprise Server for SAP Applications 12 SP5

libpython3_4m1_0-3.4.10-25.66.1

libpython3_4m1_0-32bit-3.4.10-25.66.1

python3-3.4.10-25.66.1

python3-base-3.4.10-25.66.1

python3-curses-3.4.10-25.66.1

python3-devel-3.4.10-25.66.1

python3-tk-3.4.10-25.66.1

SUSE Linux Enterprise Software Development Kit 12 SP5

python3-dbm-3.4.10-25.66.1

python3-devel-3.4.10-25.66.1

Ссылки

https://www.suse.com/support/update/announcement/2021/suse-su-20210886-1/
Link for SUSE-SU-2021:0886-1
https://lists.suse.com/pipermail/sle-security-updates/2021-March/008520.html
E-Mail link for SUSE-SU-2021:0886-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1182379
SUSE Bug 1182379
https://www.suse.com/security/cve/CVE-2021-23336/
SUSE CVE CVE-2021-23336 page

Описание

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Затронутые продукты

Image SLES12-SP4-Azure-BYOS:libpython3_4m1_0-3.4.10-25.66.1

Image SLES12-SP4-Azure-BYOS:python3-3.4.10-25.66.1

Image SLES12-SP4-Azure-BYOS:python3-base-3.4.10-25.66.1

Image SLES12-SP4-EC2-HVM-BYOS:libpython3_4m1_0-3.4.10-25.66.1

Ссылки

https://www.suse.com/security/cve/CVE-2021-23336.html
CVE-2021-23336
https://bugzilla.suse.com/1182179
SUSE Bug 1182179
https://bugzilla.suse.com/1182379
SUSE Bug 1182379
https://bugzilla.suse.com/1182433
SUSE Bug 1182433

SUSE-SU-2021:0886-1

Описание

Список пакетов

Image SLES12-SP4-Azure-BYOS

Image SLES12-SP4-EC2-HVM-BYOS

Image SLES12-SP4-GCE-BYOS

Image SLES12-SP4-SAP-Azure

Image SLES12-SP4-SAP-Azure-BYOS

Image SLES12-SP4-SAP-Azure-LI-BYOS-Production

Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production

Image SLES12-SP4-SAP-EC2-HVM

Image SLES12-SP4-SAP-EC2-HVM-BYOS

Image SLES12-SP4-SAP-GCE

Image SLES12-SP4-SAP-GCE-BYOS

Image SLES12-SP5-Azure-BYOS

Image SLES12-SP5-Azure-Basic-On-Demand

Image SLES12-SP5-Azure-HPC-BYOS

Image SLES12-SP5-Azure-HPC-On-Demand

Image SLES12-SP5-Azure-SAP-BYOS

Image SLES12-SP5-Azure-SAP-On-Demand

Image SLES12-SP5-Azure-Standard-On-Demand

Image SLES12-SP5-EC2-BYOS

Image SLES12-SP5-EC2-ECS-On-Demand

Image SLES12-SP5-EC2-On-Demand

Image SLES12-SP5-EC2-SAP-BYOS

Image SLES12-SP5-EC2-SAP-On-Demand

Image SLES12-SP5-GCE-BYOS

Image SLES12-SP5-GCE-On-Demand

Image SLES12-SP5-GCE-SAP-BYOS

Image SLES12-SP5-GCE-SAP-On-Demand

Image SLES12-SP5-OCI-BYOS-BYOS

Image SLES12-SP5-OCI-BYOS-SAP-BYOS

Image SLES12-SP5-SAP-Azure-LI-BYOS-Production

Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production

SUSE Linux Enterprise Module for Web and Scripting 12

SUSE Linux Enterprise Server 12 SP5

SUSE Linux Enterprise Server for SAP Applications 12 SP5

SUSE Linux Enterprise Software Development Kit 12 SP5

Ссылки

Уязвимость: CVE-2021-23336

Описание

Затронутые продукты

Ссылки