Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:3940-1

Опубликовано: 10 нояб. 2022
Источник: suse-cvrf

Описание

Security update for python

This update for python fixes the following issues:

  • CVE-2021-28861: Fixed an open redirection vulnerability in the HTTP server when an URI path starts with // BaseHTTPServer (bsc#1202624).

Список пакетов

SUSE Linux Enterprise Server 12 SP2-BCL
libpython2_7-1_0-2.7.18-28.90.1
libpython2_7-1_0-32bit-2.7.18-28.90.1
python-2.7.18-28.90.1
python-32bit-2.7.18-28.90.1
python-base-2.7.18-28.90.1
python-base-32bit-2.7.18-28.90.1
python-curses-2.7.18-28.90.1
python-demo-2.7.18-28.90.1
python-doc-2.7.18-28.90.1
python-doc-pdf-2.7.18-28.90.1
python-gdbm-2.7.18-28.90.1
python-idle-2.7.18-28.90.1
python-tk-2.7.18-28.90.1
python-xml-2.7.18-28.90.1
SUSE Linux Enterprise Server 12 SP3-BCL
libpython2_7-1_0-2.7.18-28.90.1
libpython2_7-1_0-32bit-2.7.18-28.90.1
python-2.7.18-28.90.1
python-32bit-2.7.18-28.90.1
python-base-2.7.18-28.90.1
python-base-32bit-2.7.18-28.90.1
python-curses-2.7.18-28.90.1
python-demo-2.7.18-28.90.1
python-devel-2.7.18-28.90.1
python-doc-2.7.18-28.90.1
python-doc-pdf-2.7.18-28.90.1
python-gdbm-2.7.18-28.90.1
python-idle-2.7.18-28.90.1
python-tk-2.7.18-28.90.1
python-xml-2.7.18-28.90.1

Ссылки

Описание

** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

Затронутые продукты
SUSE Linux Enterprise Server 12 SP2-BCL:libpython2_7-1_0-2.7.18-28.90.1
SUSE Linux Enterprise Server 12 SP2-BCL:libpython2_7-1_0-32bit-2.7.18-28.90.1
SUSE Linux Enterprise Server 12 SP2-BCL:python-2.7.18-28.90.1
SUSE Linux Enterprise Server 12 SP2-BCL:python-32bit-2.7.18-28.90.1
Ссылки
Уязвимость SUSE-SU-2022:3940-1