Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS2-2021-1670
HistoryJun 16, 2021 - 8:37 p.m.

Medium: python3

2021-06-1620:37:00
alas.aws.amazon.com
65
python
http request manipulation
cve-2020-26116
cve-2020-27619
confidentiality
integrity

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.007

Percentile

80.1%

JSON

Issue Overview:

A flaw was found in Python. The built-in modules httplib and http.client (included in Python 2 and Python 3, respectively) do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity. (CVE-2020-26116)

In Python3’s Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. (CVE-2020-27619)

Affected Packages:

python3

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update python3 to update your system.

New Packages:

aarch64:  
    python3-3.7.10-1.amzn2.0.1.aarch64  
    python3-libs-3.7.10-1.amzn2.0.1.aarch64  
    python3-devel-3.7.10-1.amzn2.0.1.aarch64  
    python3-tools-3.7.10-1.amzn2.0.1.aarch64  
    python3-tkinter-3.7.10-1.amzn2.0.1.aarch64  
    python3-test-3.7.10-1.amzn2.0.1.aarch64  
    python3-debug-3.7.10-1.amzn2.0.1.aarch64  
    python3-debuginfo-3.7.10-1.amzn2.0.1.aarch64  
  
i686:  
    python3-3.7.10-1.amzn2.0.1.i686  
    python3-libs-3.7.10-1.amzn2.0.1.i686  
    python3-devel-3.7.10-1.amzn2.0.1.i686  
    python3-tools-3.7.10-1.amzn2.0.1.i686  
    python3-tkinter-3.7.10-1.amzn2.0.1.i686  
    python3-test-3.7.10-1.amzn2.0.1.i686  
    python3-debug-3.7.10-1.amzn2.0.1.i686  
    python3-debuginfo-3.7.10-1.amzn2.0.1.i686  
  
src:  
    python3-3.7.10-1.amzn2.0.1.src  
  
x86_64:  
    python3-3.7.10-1.amzn2.0.1.x86_64  
    python3-libs-3.7.10-1.amzn2.0.1.x86_64  
    python3-devel-3.7.10-1.amzn2.0.1.x86_64  
    python3-tools-3.7.10-1.amzn2.0.1.x86_64  
    python3-tkinter-3.7.10-1.amzn2.0.1.x86_64  
    python3-test-3.7.10-1.amzn2.0.1.x86_64  
    python3-debug-3.7.10-1.amzn2.0.1.x86_64  
    python3-debuginfo-3.7.10-1.amzn2.0.1.x86_64

Additional References

Red Hat: CVE-2020-26116, CVE-2020-27619

Mitre: CVE-2020-26116, CVE-2020-27619

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64python3< 3.7.10-1.amzn2.0.1python3-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-libs< 3.7.10-1.amzn2.0.1python3-libs-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-devel< 3.7.10-1.amzn2.0.1python3-devel-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-tools< 3.7.10-1.amzn2.0.1python3-tools-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-tkinter< 3.7.10-1.amzn2.0.1python3-tkinter-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-test< 3.7.10-1.amzn2.0.1python3-test-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-debug< 3.7.10-1.amzn2.0.1python3-debug-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-debuginfo< 3.7.10-1.amzn2.0.1python3-debuginfo-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2i686python3< 3.7.10-1.amzn2.0.1python3-3.7.10-1.amzn2.0.1.i686.rpm
Amazon Linux2i686python3-libs< 3.7.10-1.amzn2.0.1python3-libs-3.7.10-1.amzn2.0.1.i686.rpm
Rows per page:
1-10 of 241

Related

nessus 64
openvas 51
almalinux 1
cloudlinux 2
redhat 2
oraclelinux 1
amazon 3
prion 3
gentoo 2
cvelist 3
osv 15
nvd 3
ubuntucve 3
mageia 2
debiancve 2
veracode 2
cbl_mariner 2
ibm 5
photon 4
ubuntu 6
cve 3
paloalto 1
redhatcve 2
fedora 6
f5 1
suse 2
cloudfoundry 4
hackerone 1
archlinux 1
github 1
debian 1
nessus
nessus
EulerOS Virtualization for ARM 64 3.0.6.0 : python3 (EulerOS-SA-2021-1560)
2021-03-04 00:00:00
Amazon Linux 2 : python3 (ALAS-2021-1670)
2023-01-04 00:00:00
EulerOS Virtualization 3.0.6.6 : python (EulerOS-SA-2021-1512)
2021-03-04 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2021-1649)
2021-03-12 00:00:00
Huawei EulerOS: Security Advisory for python2 (EulerOS-SA-2021-1543)
2021-03-05 00:00:00
Huawei EulerOS: Security Advisory for python (EulerOS-SA-2021-1114)
2021-01-19 00:00:00
almalinux
almalinux
Moderate: python3 security update
2021-05-18 05:42:46
cloudlinux
cloudlinux
Fix of CVE: CVE-2020-26116, CVE-2020-8492, CVE-2018-20852, CVE-2020-27619
2021-10-05 14:07:59
Fix of CVE: CVE-2018-20852, CVE-2020-8492, CVE-2020-26116, CVE-2020-27619
2021-09-23 12:55:16
redhat
redhat
(RHSA-2021:1633) Moderate: python3 security update
2021-05-18 05:42:46
(RHSA-2021:3366) Moderate: python3 security update
2021-08-31 08:21:02
oraclelinux
oraclelinux
python3 security update
2021-05-25 00:00:00
amazon
amazon
Important: python3
2023-10-25 21:40:00
Medium: python27, python34, python35
2020-11-16 17:59:00
Medium: python
2021-06-16 20:37:00
prion
prion
Design/Logic Flaw
2020-10-22 03:16:00
Crlf injection
2020-09-27 04:15:00
Crlf injection
2020-09-30 18:15:00
gentoo
gentoo
GNAT Ada Suite: Remote Code Execution
2024-02-03 00:00:00
Python: Multiple vulnerabilities
2021-01-24 00:00:00
cvelist
cvelist
CVE-2020-27619
2020-10-22 00:00:00
CVE-2020-26116
2020-09-27 00:00:00
CVE-2020-26137
2020-09-29 00:00:00
osv
osv
CVE-2020-27619
2020-10-22 03:16:31
BIT-python-2020-27619
2024-03-06 11:07:26
CJK codecs tests call eval() on content retrieved via HTTP
2020-10-22 02:47:40
nvd
nvd
CVE-2020-27619
2020-10-22 03:16:31
CVE-2020-26116
2020-09-27 04:15:11
CVE-2020-26137
2020-09-30 18:15:26
ubuntucve
ubuntucve
CVE-2020-27619
2020-10-22 00:00:00
CVE-2020-26116
2020-09-27 00:00:00
CVE-2020-26137
2020-09-30 00:00:00
mageia
mageia
Updated python3 packages fix security vulnerability
2020-12-29 14:57:17
Updated python packages fix security vulnerability
2021-07-10 15:56:54
debiancve
debiancve
CVE-2020-27619
2020-10-22 03:16:31
CVE-2020-26116
2020-09-27 04:15:11
veracode
veracode
Information Disclosure
2021-02-26 02:10:49
CRLF Injection
2020-10-18 01:59:16
cbl_mariner
cbl_mariner
CVE-2020-26116 affecting package python3 3.7.7-2
2021-07-08 21:56:42
CVE-2020-27619 affecting package python3 3.7.9-4
2020-11-30 19:30:53
ibm
ibm
Security Bulletin: IBM Watson OpenScale on Cloud Pak for Data is impacted by CVE-2020-26116
2021-03-11 10:59:38
Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft File Systems Agent (CVE-2020-26116)
2021-01-12 21:39:48
Security Bulletin: Vulnerability in Open Source Python affects IBM Tivoli Application Dependency Discovery Manager (CVE-2020-26116)
2021-04-12 12:07:52
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-1.0-0332
2020-10-14 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0289
2020-10-14 00:00:00
Critical Photon OS Security Update - PHSA-2020-0161
2020-11-07 00:00:00
ubuntu
ubuntu
Python vulnerability
2020-10-14 00:00:00
Python vulnerability
2022-02-08 00:00:00
Python regression
2021-02-25 00:00:00
cve
cve
CVE-2020-27619
2020-10-22 03:16:31
CVE-2020-26116
2020-09-27 04:15:11
CVE-2020-26137
2020-09-30 18:15:26
paloalto
paloalto
Informational: Impact of Python Test Suite Vulnerability CVE-2020-27619
2021-02-10 17:00:00
redhatcve
redhatcve
CVE-2020-27619
2020-10-22 14:34:14
CVE-2020-26116
2020-10-02 02:06:52
fedora
fedora
[SECURITY] Fedora 32 Update: mingw-python3-3.8.3-7.fc32
2020-11-17 01:14:12
[SECURITY] Fedora 31 Update: python2-2.7.18-6.fc31
2020-10-30 01:15:15
[SECURITY] Fedora 32 Update: python27-2.7.18-6.fc32
2020-10-16 15:21:26
f5
f5
K000133759 : Python vulnerability CVE-2020-26116
2023-05-08 00:00:00
suse
suse
Security update for python (moderate)
2020-11-21 00:00:00
Security update for python (moderate)
2020-11-07 00:00:00
cloudfoundry
cloudfoundry
USN-4581-1: Python vulnerability | Cloud Foundry
2020-11-19 00:00:00
USN-4754-4: Python 2.7 vulnerability | Cloud Foundry
2021-03-22 00:00:00
USN-4754-1: Python vulnerabilities | Cloud Foundry
2021-03-02 00:00:00
hackerone
hackerone
Ruby: 'net/http': HTTP Header Injection in the set_content_type method
2021-04-19 09:25:39
archlinux
archlinux
[ASA-202103-27] python2: multiple issues
2021-03-25 00:00:00
github
github
CRLF injection in urllib3
2021-06-18 18:46:43
debian
debian
[SECURITY] [DLA 2456-1] python3.5 security update
2020-11-19 03:44:14

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.007

Percentile

80.1%

JSON
Related for ALAS2-2021-1670
nessus64openvas51almalinux1cloudlinux2redhat2oraclelinux1amazon3prion3gentoo2cvelist3osv15nvd3ubuntucve3mageia2debiancve2veracode2cbl_mariner2ibm5photon4ubuntu6cve3paloalto1redhatcve2fedora6f51suse2cloudfoundry4hackerone1archlinux1github1debian1