Описание
Security update for python
This update for python fixes the following issues:
- CVE-2023-52425: Fixed using the system libexpat (bsc#1219559).
- CVE-2023-27043: Modifed fix for unicode string handling in email.utils.parseaddr() (bsc#1222537).
- CVE-2022-48560: Fixed use-after-free in Python via heappushpop in heapq (bsc#1214675).
Bug fixes:
- Switch off tests. ONLY FOR FACTORY!!! (bsc#1219306).
- Build with -std=gnu89 to build correctly with gcc14 (bsc#1220970).
- Switch from %patchN style to the %patch -P N one.
Список пакетов
Image SLES12-SP5-Azure-BYOS
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-Azure-Basic-On-Demand
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-Azure-HPC-BYOS
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-Azure-HPC-On-Demand
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-Azure-SAP-BYOS
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-Azure-SAP-On-Demand
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-Azure-Standard-On-Demand
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-EC2-BYOS
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-EC2-ECS-On-Demand
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-EC2-On-Demand
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-EC2-SAP-BYOS
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-EC2-SAP-On-Demand
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-GCE-BYOS
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-GCE-On-Demand
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-GCE-SAP-BYOS
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-GCE-SAP-On-Demand
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
libpython2_7-1_0-2.7.18-33.32.1
python-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
SUSE Linux Enterprise Server 12 SP5
libpython2_7-1_0-2.7.18-33.32.1
libpython2_7-1_0-32bit-2.7.18-33.32.1
python-2.7.18-33.32.1
python-32bit-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-base-32bit-2.7.18-33.32.1
python-curses-2.7.18-33.32.1
python-demo-2.7.18-33.32.1
python-devel-2.7.18-33.32.1
python-doc-2.7.18-33.32.1
python-doc-pdf-2.7.18-33.32.1
python-gdbm-2.7.18-33.32.1
python-idle-2.7.18-33.32.1
python-tk-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
libpython2_7-1_0-2.7.18-33.32.1
libpython2_7-1_0-32bit-2.7.18-33.32.1
python-2.7.18-33.32.1
python-32bit-2.7.18-33.32.1
python-base-2.7.18-33.32.1
python-base-32bit-2.7.18-33.32.1
python-curses-2.7.18-33.32.1
python-demo-2.7.18-33.32.1
python-devel-2.7.18-33.32.1
python-doc-2.7.18-33.32.1
python-doc-pdf-2.7.18-33.32.1
python-gdbm-2.7.18-33.32.1
python-idle-2.7.18-33.32.1
python-tk-2.7.18-33.32.1
python-xml-2.7.18-33.32.1
SUSE Linux Enterprise Workstation Extension 12 SP5
python-devel-2.7.18-33.32.1
Ссылки
- Link for SUSE-SU-2024:1667-1
- E-Mail link for SUSE-SU-2024:1667-1
- SUSE Security Ratings
- SUSE Bug 1214675
- SUSE Bug 1219306
- SUSE Bug 1219559
- SUSE Bug 1220970
- SUSE Bug 1222537
- SUSE CVE CVE-2022-48560 page
- SUSE CVE CVE-2023-27043 page
- SUSE CVE CVE-2023-52425 page
Описание
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
Затронутые продукты
Image SLES12-SP5-Azure-BYOS:libpython2_7-1_0-2.7.18-33.32.1
Image SLES12-SP5-Azure-BYOS:python-2.7.18-33.32.1
Image SLES12-SP5-Azure-BYOS:python-base-2.7.18-33.32.1
Image SLES12-SP5-Azure-BYOS:python-xml-2.7.18-33.32.1
Ссылки
- CVE-2022-48560
- SUSE Bug 1214675
Описание
The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.
Затронутые продукты
Image SLES12-SP5-Azure-BYOS:libpython2_7-1_0-2.7.18-33.32.1
Image SLES12-SP5-Azure-BYOS:python-2.7.18-33.32.1
Image SLES12-SP5-Azure-BYOS:python-base-2.7.18-33.32.1
Image SLES12-SP5-Azure-BYOS:python-xml-2.7.18-33.32.1
Ссылки
- CVE-2023-27043
- SUSE Bug 1210638
- SUSE Bug 1222537
Описание
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
Затронутые продукты
Image SLES12-SP5-Azure-BYOS:libpython2_7-1_0-2.7.18-33.32.1
Image SLES12-SP5-Azure-BYOS:python-2.7.18-33.32.1
Image SLES12-SP5-Azure-BYOS:python-base-2.7.18-33.32.1
Image SLES12-SP5-Azure-BYOS:python-xml-2.7.18-33.32.1
Ссылки
- CVE-2023-52425
- SUSE Bug 1219559