SUSE-SU-2023:0724-1

Опубликовано: 14 мар. 2023

Источник: suse-cvrf

Описание

Security update for python

This update for python fixes the following issues:

CVE-2023-24329: Fixed blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters (bsc#1208471).
CVE-2022-45061: Fixed DoS when IDNA decodes extremely long domain names (bsc#1205244).

The following non-security bug was fixed:

Making compileall.py compliant with year 2038 (bsc#1202666, gh#python/cpython#79171).

Список пакетов

Image SLES15-SP2-SAP-Azure

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

Image SLES15-SP2-SAP-BYOS-Azure

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP2-SAP-BYOS-EC2-HVM

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP2-SAP-BYOS-GCE

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP2-SAP-EC2-HVM

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP2-SAP-GCE

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

libpython2_7-1_0-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

Image SLES15-SP3-SAPCAL-Azure

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP3-SAPCAL-EC2-HVM

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Image SLES15-SP3-SAPCAL-GCE

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Enterprise Storage 7

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-curses-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-gdbm-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Enterprise Storage 7.1

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-curses-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-gdbm-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-curses-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-gdbm-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise Module for Package Hub 15 SP4

python-devel-2.7.18-150000.48.1

SUSE Linux Enterprise Real Time 15 SP3

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise Server 15 SP1-LTSS

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-curses-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-gdbm-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise Server 15 SP2-LTSS

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-curses-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-gdbm-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise Server 15 SP3-LTSS

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise Server for SAP Applications 15 SP1

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-curses-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-gdbm-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise Server for SAP Applications 15 SP2

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-curses-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-gdbm-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Linux Enterprise Server for SAP Applications 15 SP3

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

SUSE Manager Proxy 4.2

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

SUSE Manager Server 4.2

libpython2_7-1_0-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-curses-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-gdbm-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

openSUSE Leap 15.4

libpython2_7-1_0-2.7.18-150000.48.1

libpython2_7-1_0-32bit-2.7.18-150000.48.1

python-2.7.18-150000.48.1

python-32bit-2.7.18-150000.48.1

python-base-2.7.18-150000.48.1

python-base-32bit-2.7.18-150000.48.1

python-curses-2.7.18-150000.48.1

python-demo-2.7.18-150000.48.1

python-devel-2.7.18-150000.48.1

python-doc-2.7.18-150000.48.1

python-doc-pdf-2.7.18-150000.48.1

python-gdbm-2.7.18-150000.48.1

python-idle-2.7.18-150000.48.1

python-tk-2.7.18-150000.48.1

python-xml-2.7.18-150000.48.1

Ссылки

https://www.suse.com/support/update/announcement/2023/suse-su-20230724-1/
Link for SUSE-SU-2023:0724-1
https://lists.suse.com/pipermail/sle-security-updates/2023-March/014033.html
E-Mail link for SUSE-SU-2023:0724-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1202666
SUSE Bug 1202666
https://bugzilla.suse.com/1205244
SUSE Bug 1205244
https://bugzilla.suse.com/1208471
SUSE Bug 1208471
https://www.suse.com/security/cve/CVE-2022-45061/
SUSE CVE CVE-2022-45061 page
https://www.suse.com/security/cve/CVE-2023-24329/
SUSE CVE CVE-2023-24329 page

Описание

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Затронутые продукты

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:libpython2_7-1_0-2.7.18-150000.48.1

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:python-base-2.7.18-150000.48.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:libpython2_7-1_0-2.7.18-150000.48.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:python-base-2.7.18-150000.48.1

Ссылки

https://www.suse.com/security/cve/CVE-2022-45061.html
CVE-2022-45061
https://bugzilla.suse.com/1205244
SUSE Bug 1205244
https://bugzilla.suse.com/1211488
SUSE Bug 1211488

Описание

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Затронутые продукты

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:libpython2_7-1_0-2.7.18-150000.48.1

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:python-base-2.7.18-150000.48.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:libpython2_7-1_0-2.7.18-150000.48.1

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:python-base-2.7.18-150000.48.1

Ссылки

https://www.suse.com/security/cve/CVE-2023-24329.html
CVE-2023-24329
https://bugzilla.suse.com/1208471
SUSE Bug 1208471
https://bugzilla.suse.com/1213553
SUSE Bug 1213553
https://bugzilla.suse.com/1213554
SUSE Bug 1213554
https://bugzilla.suse.com/1213839
SUSE Bug 1213839
https://bugzilla.suse.com/1225672
SUSE Bug 1225672

SUSE-SU-2023:0724-1

Описание

Список пакетов

Image SLES15-SP2-SAP-Azure

Image SLES15-SP2-SAP-Azure-LI-BYOS-Production

Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP2-SAP-BYOS-Azure

Image SLES15-SP2-SAP-BYOS-EC2-HVM

Image SLES15-SP2-SAP-BYOS-GCE

Image SLES15-SP2-SAP-EC2-HVM

Image SLES15-SP2-SAP-GCE

Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure

Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM

Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE

Image SLES15-SP3-SAP-Azure-LI-BYOS-Production

Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production

Image SLES15-SP3-SAPCAL-Azure

Image SLES15-SP3-SAPCAL-EC2-HVM

Image SLES15-SP3-SAPCAL-GCE

SUSE Enterprise Storage 7

SUSE Enterprise Storage 7.1

SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS

SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS

SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

SUSE Linux Enterprise Module for Package Hub 15 SP4

SUSE Linux Enterprise Real Time 15 SP3

SUSE Linux Enterprise Server 15 SP1-LTSS

SUSE Linux Enterprise Server 15 SP2-LTSS

SUSE Linux Enterprise Server 15 SP3-LTSS

SUSE Linux Enterprise Server for SAP Applications 15 SP1

SUSE Linux Enterprise Server for SAP Applications 15 SP2

SUSE Linux Enterprise Server for SAP Applications 15 SP3

SUSE Manager Proxy 4.2

SUSE Manager Server 4.2

openSUSE Leap 15.4

Ссылки

Уязвимость: CVE-2022-45061

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2023-24329

Описание

Затронутые продукты

Ссылки