| Description: | Summary:
The remote host is missing an update for the 'python, python3' package(s) announced via the MGASA-2019-0318 advisory.
Vulnerability Insight:
Updated python and python3 packages fix security vulnerabilities:
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
controls a url parameter, as demonstrated by the first argument to
urllib.request.urlopen with \r\n followed by an HTTP header or a Redis
command (CVE-2019-9740).
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib
in Python 3.x through 3.7.2. CRLF injection is possible if the attacker
controls a url parameter, as demonstrated by the first argument to
urllib.request.urlopen with \r\n (specifically in the path component of a
URL) followed by an HTTP header or a Redis command. This is similar to
CVE-2019-9740 query string issue (CVE-2019-9947).
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which
makes it easier for remote attackers to bypass protection mechanisms that
blacklist file: URIs, as demonstrated by triggering a
urllib.urlopen('local_file:///etc/passwd') call (CVE-2019-9948).
A security regression of CVE-2019-9636 was discovered in python, which
still allows an attacker to exploit CVE-2019-9636 by abusing the user and
password parts of a URL. When an application parses user-supplied URLs to
store cookies, authentication credentials, or other kind of information,
it is possible for an attacker to provide specially crafted URLs to make
the application locate host-related information (e.g. cookies,
authentication data) and send them to a different host than where it
should, unlike if the URLs had been correctly parsed. The result of an
attack may vary based on the application (CVE-2019-10160).
It was discovered that Python incorrectly parsed certain email addresses.
A remote attacker could possibly use this issue to trick Python
applications into accepting email addresses that should be denied
(CVE-2019-16056).
It was discovered that the Python documentation XML-RPC server incorrectly
handled certain fields. A remote attacker could use this issue to execute
a cross-site scripting (XSS) attack (CVE-2019-16935).
Affected Software/OS:
'python, python3' package(s) on Mageia 7.
Solution:
Please install the updated package(s).
CVSS Score:
6.4
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:N
|
