Security update for python SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0435-1 Final 1 1 2021-03-17T13:06:16Z current 2021-03-17T13:06:16Z 2021-03-17T13:06:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python This update for python fixes the following issues: - python27 was upgraded to 2.7.18 - CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator (bsc#1182379). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-435 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LBJTTJNYOY4PWTVR3WGVSEX33BCEYHGD/ E-Mail link for openSUSE-SU-2021:0435-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1182379 SUSE Bug 1182379 https://www.suse.com/security/cve/CVE-2021-23336/ SUSE CVE CVE-2021-23336 page openSUSE Leap 15.2 libpython2_7-1_0-2.7.18-lp152.3.15.1 libpython2_7-1_0-32bit-2.7.18-lp152.3.15.1 python-2.7.18-lp152.3.15.1 python-32bit-2.7.18-lp152.3.15.1 python-base-2.7.18-lp152.3.15.1 python-base-32bit-2.7.18-lp152.3.15.1 python-curses-2.7.18-lp152.3.15.1 python-demo-2.7.18-lp152.3.15.1 python-devel-2.7.18-lp152.3.15.1 python-doc-2.7.18-lp152.3.15.1 python-doc-pdf-2.7.18-lp152.3.15.1 python-gdbm-2.7.18-lp152.3.15.1 python-idle-2.7.18-lp152.3.15.1 python-tk-2.7.18-lp152.3.15.1 python-xml-2.7.18-lp152.3.15.1 libpython2_7-1_0-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 libpython2_7-1_0-32bit-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-32bit-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-base-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-base-32bit-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-curses-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-demo-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-devel-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-doc-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-doc-pdf-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-gdbm-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-idle-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-tk-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 python-xml-2.7.18-lp152.3.15.1 as a component of openSUSE Leap 15.2 The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. CVE-2021-23336 openSUSE Leap 15.2:libpython2_7-1_0-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:libpython2_7-1_0-32bit-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-32bit-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-base-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-base-32bit-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-curses-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-demo-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-devel-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-doc-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-doc-pdf-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-gdbm-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-idle-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-tk-2.7.18-lp152.3.15.1 openSUSE Leap 15.2:python-xml-2.7.18-lp152.3.15.1 moderate 4 AV:N/AC:H/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LBJTTJNYOY4PWTVR3WGVSEX33BCEYHGD/ https://www.suse.com/security/cve/CVE-2021-23336.html CVE-2021-23336 https://bugzilla.suse.com/1182179 SUSE Bug 1182179 https://bugzilla.suse.com/1182379 SUSE Bug 1182379 https://bugzilla.suse.com/1182433 SUSE Bug 1182433