Security update for python3 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:2332-1 Final 1 1 2020-12-28T20:41:38Z current 2020-12-28T20:41:38Z 2020-12-28T20:41:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python3 This update for python3 fixes the following issues: - Fixed CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support calls eval() on content retrieved via HTTP. - Change setuptools and pip version numbers according to new wheels - Handful of changes to make python36 compatible with SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738) - add triplets for mips-r6 and riscv - RISC-V needs CTYPES_PASS_BY_REF_HACK Update to 3.6.12 (bsc#1179193) * Ensure python3.dll is loaded from correct locations when Python is embedded * The __hash__() methods of ipaddress.IPv4Interface and ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and 128 respectively. This resulted in always causing hash collisions. The fix uses hash() to generate hash values for the tuple of (address, mask length, network address). * Prevent http header injection by rejecting control characters in http.client.putrequest(…). * Unpickling invalid NEWOBJ_EX opcode with the C implementation raises now UnpicklingError instead of crashing. * Avoid infinite loop when reading specially crafted TAR files using the tarfile module - This release also fixes CVE-2020-26116 (bsc#1177211) and CVE-2019-20907 (bsc#1174091). Update to 3.6.11: - Disallow CR or LF in email.headerregistry. Address arguments to guard against header injection attacks. - Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised. (bsc#1155094) - CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager. This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-2332 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3JTHM6LLDKL7VPNRJUSRPNZAD2FZ25H/ E-Mail link for openSUSE-SU-2020:2332-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1155094 SUSE Bug 1155094 https://bugzilla.suse.com/1174091 SUSE Bug 1174091 https://bugzilla.suse.com/1174571 SUSE Bug 1174571 https://bugzilla.suse.com/1174701 SUSE Bug 1174701 https://bugzilla.suse.com/1177211 SUSE Bug 1177211 https://bugzilla.suse.com/1178009 SUSE Bug 1178009 https://bugzilla.suse.com/1179193 SUSE Bug 1179193 https://bugzilla.suse.com/1179630 SUSE Bug 1179630 https://www.suse.com/security/cve/CVE-2019-16935/ SUSE CVE CVE-2019-16935 page https://www.suse.com/security/cve/CVE-2019-18348/ SUSE CVE CVE-2019-18348 page https://www.suse.com/security/cve/CVE-2019-20907/ SUSE CVE CVE-2019-20907 page https://www.suse.com/security/cve/CVE-2019-5010/ SUSE CVE CVE-2019-5010 page https://www.suse.com/security/cve/CVE-2020-14422/ SUSE CVE CVE-2020-14422 page https://www.suse.com/security/cve/CVE-2020-26116/ SUSE CVE CVE-2020-26116 page https://www.suse.com/security/cve/CVE-2020-27619/ SUSE CVE CVE-2020-27619 page https://www.suse.com/security/cve/CVE-2020-8492/ SUSE CVE CVE-2020-8492 page openSUSE Leap 15.2 libpython3_6m1_0-3.6.12-lp152.4.14.1 libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 python3-3.6.12-lp152.4.14.1 python3-32bit-3.6.12-lp152.4.14.1 python3-base-3.6.12-lp152.4.14.1 python3-base-32bit-3.6.12-lp152.4.14.1 python3-curses-3.6.12-lp152.4.14.1 python3-dbm-3.6.12-lp152.4.14.1 python3-devel-3.6.12-lp152.4.14.1 python3-doc-3.6.12-lp152.4.14.1 python3-doc-devhelp-3.6.12-lp152.4.14.1 python3-idle-3.6.12-lp152.4.14.1 python3-testsuite-3.6.12-lp152.4.14.1 python3-tk-3.6.12-lp152.4.14.1 python3-tools-3.6.12-lp152.4.14.1 libpython3_6m1_0-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-32bit-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-base-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-base-32bit-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-curses-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-dbm-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-devel-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-doc-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-doc-devhelp-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-idle-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-testsuite-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-tk-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 python3-tools-3.6.12-lp152.4.14.1 as a component of openSUSE Leap 15.2 The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server. CVE-2019-16935 openSUSE Leap 15.2:libpython3_6m1_0-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-curses-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-dbm-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-devel-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-devhelp-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-idle-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-testsuite-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tk-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tools-3.6.12-lp152.4.14.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3JTHM6LLDKL7VPNRJUSRPNZAD2FZ25H/ https://www.suse.com/security/cve/CVE-2019-16935.html CVE-2019-16935 https://bugzilla.suse.com/1153238 SUSE Bug 1153238 An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1. CVE-2019-18348 openSUSE Leap 15.2:libpython3_6m1_0-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-curses-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-dbm-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-devel-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-devhelp-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-idle-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-testsuite-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tk-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tools-3.6.12-lp152.4.14.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3JTHM6LLDKL7VPNRJUSRPNZAD2FZ25H/ https://www.suse.com/security/cve/CVE-2019-18348.html CVE-2019-18348 https://bugzilla.suse.com/1155094 SUSE Bug 1155094 In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. CVE-2019-20907 openSUSE Leap 15.2:libpython3_6m1_0-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-curses-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-dbm-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-devel-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-devhelp-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-idle-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-testsuite-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tk-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tools-3.6.12-lp152.4.14.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3JTHM6LLDKL7VPNRJUSRPNZAD2FZ25H/ https://www.suse.com/security/cve/CVE-2019-20907.html CVE-2019-20907 https://bugzilla.suse.com/1174091 SUSE Bug 1174091 An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability. CVE-2019-5010 openSUSE Leap 15.2:libpython3_6m1_0-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-curses-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-dbm-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-devel-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-devhelp-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-idle-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-testsuite-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tk-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tools-3.6.12-lp152.4.14.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3JTHM6LLDKL7VPNRJUSRPNZAD2FZ25H/ https://www.suse.com/security/cve/CVE-2019-5010.html CVE-2019-5010 https://bugzilla.suse.com/1122191 SUSE Bug 1122191 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2. CVE-2020-14422 openSUSE Leap 15.2:libpython3_6m1_0-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-curses-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-dbm-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-devel-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-devhelp-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-idle-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-testsuite-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tk-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tools-3.6.12-lp152.4.14.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3JTHM6LLDKL7VPNRJUSRPNZAD2FZ25H/ https://www.suse.com/security/cve/CVE-2020-14422.html CVE-2020-14422 https://bugzilla.suse.com/1173274 SUSE Bug 1173274 http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. CVE-2020-26116 openSUSE Leap 15.2:libpython3_6m1_0-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-curses-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-dbm-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-devel-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-devhelp-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-idle-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-testsuite-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tk-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tools-3.6.12-lp152.4.14.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3JTHM6LLDKL7VPNRJUSRPNZAD2FZ25H/ https://www.suse.com/security/cve/CVE-2020-26116.html CVE-2020-26116 https://bugzilla.suse.com/1177120 SUSE Bug 1177120 https://bugzilla.suse.com/1177211 SUSE Bug 1177211 https://bugzilla.suse.com/1192361 SUSE Bug 1192361 In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. CVE-2020-27619 openSUSE Leap 15.2:libpython3_6m1_0-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-curses-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-dbm-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-devel-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-devhelp-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-idle-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-testsuite-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tk-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tools-3.6.12-lp152.4.14.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3JTHM6LLDKL7VPNRJUSRPNZAD2FZ25H/ https://www.suse.com/security/cve/CVE-2020-27619.html CVE-2020-27619 https://bugzilla.suse.com/1178009 SUSE Bug 1178009 https://bugzilla.suse.com/1180254 SUSE Bug 1180254 https://bugzilla.suse.com/1193386 SUSE Bug 1193386 Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. CVE-2020-8492 openSUSE Leap 15.2:libpython3_6m1_0-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:libpython3_6m1_0-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-base-32bit-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-curses-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-dbm-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-devel-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-doc-devhelp-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-idle-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-testsuite-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tk-3.6.12-lp152.4.14.1 openSUSE Leap 15.2:python3-tools-3.6.12-lp152.4.14.1 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/S3JTHM6LLDKL7VPNRJUSRPNZAD2FZ25H/ https://www.suse.com/security/cve/CVE-2020-8492.html CVE-2020-8492 https://bugzilla.suse.com/1162367 SUSE Bug 1162367