SUSE-SU-2022:3512-1

Опубликовано: 17 окт. 2022

Источник: suse-cvrf

Описание

Security update for python

This update for python fixes the following issues:

CVE-2021-28861: Fixed an open redirection vulnerability in the HTTP server when an URI path starts with // (bsc#1202624).

Список пакетов

Image SLES15-SP1-SAPCAL-Azure

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP1-SAPCAL-EC2-HVM

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP1-SAPCAL-GCE

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP2-SAP-Azure

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

Image SLES15-SP2-SAP-BYOS-Azure

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP2-SAP-BYOS-EC2-HVM

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP2-SAP-BYOS-GCE

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP2-SAP-EC2-HVM

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP2-SAP-GCE

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

libpython2_7-1_0-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

Image SLES15-SP3-SAPCAL-Azure

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP3-SAPCAL-EC2-HVM

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Image SLES15-SP3-SAPCAL-GCE

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

SUSE Linux Enterprise Module for Basesystem 15 SP3

libpython2_7-1_0-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

SUSE Linux Enterprise Module for Desktop Applications 15 SP3

python-tk-2.7.18-150000.44.1

SUSE Linux Enterprise Module for Python 2 15 SP3

python-curses-2.7.18-150000.44.1

python-devel-2.7.18-150000.44.1

python-gdbm-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

openSUSE Leap 15.3

libpython2_7-1_0-2.7.18-150000.44.1

libpython2_7-1_0-32bit-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-32bit-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-base-32bit-2.7.18-150000.44.1

python-curses-2.7.18-150000.44.1

python-demo-2.7.18-150000.44.1

python-devel-2.7.18-150000.44.1

python-doc-2.7.18-150000.44.1

python-doc-pdf-2.7.18-150000.44.1

python-gdbm-2.7.18-150000.44.1

python-idle-2.7.18-150000.44.1

python-tk-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

openSUSE Leap 15.4

libpython2_7-1_0-2.7.18-150000.44.1

libpython2_7-1_0-32bit-2.7.18-150000.44.1

python-2.7.18-150000.44.1

python-32bit-2.7.18-150000.44.1

python-base-2.7.18-150000.44.1

python-base-32bit-2.7.18-150000.44.1

python-curses-2.7.18-150000.44.1

python-demo-2.7.18-150000.44.1

python-devel-2.7.18-150000.44.1

python-doc-2.7.18-150000.44.1

python-doc-pdf-2.7.18-150000.44.1

python-gdbm-2.7.18-150000.44.1

python-idle-2.7.18-150000.44.1

python-tk-2.7.18-150000.44.1

python-xml-2.7.18-150000.44.1

Ссылки

https://www.suse.com/support/update/announcement/2022/suse-su-20223512-1/
Link for SUSE-SU-2022:3512-1
https://lists.suse.com/pipermail/sle-security-updates/2022-October/012483.html
E-Mail link for SUSE-SU-2022:3512-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1202624
SUSE Bug 1202624
https://www.suse.com/security/cve/CVE-2021-28861/
SUSE CVE CVE-2021-28861 page

Описание

** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

Затронутые продукты

Image SLES15-SP1-SAPCAL-Azure:libpython2_7-1_0-2.7.18-150000.44.1

Image SLES15-SP1-SAPCAL-Azure:python-2.7.18-150000.44.1

Image SLES15-SP1-SAPCAL-Azure:python-base-2.7.18-150000.44.1

Image SLES15-SP1-SAPCAL-Azure:python-xml-2.7.18-150000.44.1

Ссылки

https://www.suse.com/security/cve/CVE-2021-28861.html
CVE-2021-28861
https://bugzilla.suse.com/1202624
SUSE Bug 1202624
https://bugzilla.suse.com/1204077
SUSE Bug 1204077
https://bugzilla.suse.com/1204801
SUSE Bug 1204801
https://bugzilla.suse.com/1204802
SUSE Bug 1204802
https://bugzilla.suse.com/1205068
SUSE Bug 1205068
https://bugzilla.suse.com/1205075
SUSE Bug 1205075
https://bugzilla.suse.com/1205467
SUSE Bug 1205467

SUSE-SU-2022:3512-1

Описание

Список пакетов

Image SLES15-SP1-SAPCAL-Azure

Image SLES15-SP1-SAPCAL-EC2-HVM

Image SLES15-SP1-SAPCAL-GCE

Image SLES15-SP2-SAP-Azure

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP2-SAP-BYOS-Azure

Image SLES15-SP2-SAP-BYOS-EC2-HVM

Image SLES15-SP2-SAP-BYOS-GCE

Image SLES15-SP2-SAP-EC2-HVM

Image SLES15-SP2-SAP-GCE

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP3-SAPCAL-Azure

Image SLES15-SP3-SAPCAL-EC2-HVM

Image SLES15-SP3-SAPCAL-GCE

SUSE Linux Enterprise Module for Basesystem 15 SP3

SUSE Linux Enterprise Module for Desktop Applications 15 SP3

SUSE Linux Enterprise Module for Python 2 15 SP3

openSUSE Leap 15.3

openSUSE Leap 15.4

Ссылки

Уязвимость: CVE-2021-28861

Описание

Затронутые продукты

Ссылки