Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS2-2021-1670
HistoryJun 16, 2021 - 8:37 p.m.

Medium: python3

2021-06-1620:37:00
alas.aws.amazon.com
49

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

79.4%

JSON

Issue Overview:

A flaw was found in Python. The built-in modules httplib and http.client (included in Python 2 and Python 3, respectively) do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity. (CVE-2020-26116)

In Python3’s Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. (CVE-2020-27619)

Affected Packages:

python3

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update python3 to update your system.

New Packages:

aarch64:  
    python3-3.7.10-1.amzn2.0.1.aarch64  
    python3-libs-3.7.10-1.amzn2.0.1.aarch64  
    python3-devel-3.7.10-1.amzn2.0.1.aarch64  
    python3-tools-3.7.10-1.amzn2.0.1.aarch64  
    python3-tkinter-3.7.10-1.amzn2.0.1.aarch64  
    python3-test-3.7.10-1.amzn2.0.1.aarch64  
    python3-debug-3.7.10-1.amzn2.0.1.aarch64  
    python3-debuginfo-3.7.10-1.amzn2.0.1.aarch64  
  
i686:  
    python3-3.7.10-1.amzn2.0.1.i686  
    python3-libs-3.7.10-1.amzn2.0.1.i686  
    python3-devel-3.7.10-1.amzn2.0.1.i686  
    python3-tools-3.7.10-1.amzn2.0.1.i686  
    python3-tkinter-3.7.10-1.amzn2.0.1.i686  
    python3-test-3.7.10-1.amzn2.0.1.i686  
    python3-debug-3.7.10-1.amzn2.0.1.i686  
    python3-debuginfo-3.7.10-1.amzn2.0.1.i686  
  
src:  
    python3-3.7.10-1.amzn2.0.1.src  
  
x86_64:  
    python3-3.7.10-1.amzn2.0.1.x86_64  
    python3-libs-3.7.10-1.amzn2.0.1.x86_64  
    python3-devel-3.7.10-1.amzn2.0.1.x86_64  
    python3-tools-3.7.10-1.amzn2.0.1.x86_64  
    python3-tkinter-3.7.10-1.amzn2.0.1.x86_64  
    python3-test-3.7.10-1.amzn2.0.1.x86_64  
    python3-debug-3.7.10-1.amzn2.0.1.x86_64  
    python3-debuginfo-3.7.10-1.amzn2.0.1.x86_64

Additional References

Red Hat: CVE-2020-26116, CVE-2020-27619

Mitre: CVE-2020-26116, CVE-2020-27619

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64python3< 3.7.10-1.amzn2.0.1python3-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-libs< 3.7.10-1.amzn2.0.1python3-libs-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-devel< 3.7.10-1.amzn2.0.1python3-devel-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-tools< 3.7.10-1.amzn2.0.1python3-tools-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-tkinter< 3.7.10-1.amzn2.0.1python3-tkinter-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-test< 3.7.10-1.amzn2.0.1python3-test-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-debug< 3.7.10-1.amzn2.0.1python3-debug-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64python3-debuginfo< 3.7.10-1.amzn2.0.1python3-debuginfo-3.7.10-1.amzn2.0.1.aarch64.rpm
Amazon Linux2i686python3< 3.7.10-1.amzn2.0.1python3-3.7.10-1.amzn2.0.1.i686.rpm
Amazon Linux2i686python3-libs< 3.7.10-1.amzn2.0.1python3-libs-3.7.10-1.amzn2.0.1.i686.rpm
Rows per page:
1-10 of 241

Related

nessus 66
openvas 51
amazon 3
cloudlinux 2
redhat 2
almalinux 1
oraclelinux 1
prion 3
osv 16
gentoo 2
ubuntucve 3
mageia 2
debiancve 3
paloalto 1
cve 3
redhatcve 2
cbl_mariner 2
veracode 2
suse 2
photon 4
cloudfoundry 4
ibm 5
fedora 6
ubuntu 6
hackerone 1
f5 2
archlinux 1
github 1
alpinelinux 1
debian 1
nessus
nessus
EulerOS 2.0 SP5 : python (EulerOS-SA-2021-1226)
2021-02-04 00:00:00
EulerOS Virtualization 3.0.6.6 : python (EulerOS-SA-2021-1512)
2021-03-04 00:00:00
Amazon Linux 2 : python3 (ALAS-2021-1670)
2023-01-04 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2021-1649)
2021-03-12 00:00:00
Huawei EulerOS: Security Advisory for python2 (EulerOS-SA-2021-1543)
2021-03-05 00:00:00
Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2021-1560)
2021-03-05 00:00:00
amazon
amazon
Important: python3
2023-10-25 21:40:00
Medium: python27, python34, python35
2020-11-16 17:59:00
Medium: python
2021-06-16 20:37:00
cloudlinux
cloudlinux
Fix of CVE: CVE-2018-20852, CVE-2020-8492, CVE-2020-26116, CVE-2020-27619
2021-09-23 12:55:16
Fix of CVE: CVE-2020-26116, CVE-2020-8492, CVE-2018-20852, CVE-2020-27619
2021-10-05 14:07:59
redhat
redhat
(RHSA-2021:1633) Moderate: python3 security update
2021-05-18 05:42:46
(RHSA-2021:3366) Moderate: python3 security update
2021-08-31 08:21:02
almalinux
almalinux
Moderate: python3 security update
2021-05-18 05:42:46
oraclelinux
oraclelinux
python3 security update
2021-05-25 00:00:00
prion
prion
Design/Logic Flaw
2020-10-22 03:16:00
Crlf injection
2020-09-27 04:15:00
Crlf injection
2020-09-30 18:15:00
osv
osv
CVE-2020-27619
2020-10-22 03:16:31
CJK codecs tests call eval() on content retrieved via HTTP
2020-10-22 02:47:40
BIT-python-2020-27619
2024-03-06 11:07:26
gentoo
gentoo
GNAT Ada Suite: Remote Code Execution
2024-02-03 00:00:00
Python: Multiple vulnerabilities
2021-01-24 00:00:00
ubuntucve
ubuntucve
CVE-2020-27619
2020-10-22 00:00:00
CVE-2020-26116
2020-09-27 00:00:00
CVE-2020-26137
2020-09-30 00:00:00
mageia
mageia
Updated python3 packages fix security vulnerability
2020-12-29 14:57:17
Updated python packages fix security vulnerability
2021-07-10 15:56:54
debiancve
debiancve
CVE-2020-27619
2020-10-22 03:16:00
CVE-2020-26116
2020-09-27 04:15:00
CVE-2020-26137
2020-09-30 18:15:00
paloalto
paloalto
Informational: Impact of Python Test Suite Vulnerability CVE-2020-27619
2021-02-10 17:00:00
cve
cve
CVE-2020-27619
2020-10-22 03:16:00
CVE-2020-26116
2020-09-27 04:15:00
CVE-2020-26137
2020-09-30 18:15:00
redhatcve
redhatcve
CVE-2020-27619
2020-10-22 14:34:14
CVE-2020-26116
2020-10-02 02:06:52
cbl_mariner
cbl_mariner
CVE-2020-27619 affecting package python3 3.7.9-4
2020-11-30 19:30:53
CVE-2020-26116 affecting package python3 3.7.7-2
2021-07-08 21:56:42
veracode
veracode
Information Disclosure
2021-02-26 02:10:49
CRLF Injection
2020-10-18 01:59:16
suse
suse
Security update for python (moderate)
2020-11-21 00:00:00
Security update for python (moderate)
2020-11-07 00:00:00
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0289
2020-10-14 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-1.0-0332
2020-10-14 00:00:00
Critical Photon OS Security Update - PHSA-2020-0161
2020-11-07 00:00:00
cloudfoundry
cloudfoundry
USN-4581-1: Python vulnerability | Cloud Foundry
2020-11-19 00:00:00
USN-4754-2: Python regression | Cloud Foundry
2021-03-02 00:00:00
USN-4754-1: Python vulnerabilities | Cloud Foundry
2021-03-02 00:00:00
ibm
ibm
Security Bulletin: Vulnerability in Open Source Python affects IBM Tivoli Application Dependency Discovery Manager (CVE-2020-26116)
2021-04-12 12:07:52
Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft File Systems Agent (CVE-2020-26116)
2021-01-12 21:39:48
Security Bulletin: IBM Watson OpenScale on Cloud Pak for Data is impacted by CVE-2020-26116
2021-03-11 10:59:38
fedora
fedora
[SECURITY] Fedora 32 Update: mingw-python3-3.8.3-7.fc32
2020-11-17 01:14:12
[SECURITY] Fedora 31 Update: python2-2.7.18-6.fc31
2020-10-30 01:15:15
[SECURITY] Fedora 32 Update: python27-2.7.18-6.fc32
2020-10-16 15:21:26
ubuntu
ubuntu
Python vulnerability
2020-10-14 00:00:00
Python vulnerabilities
2021-02-25 00:00:00
Python 2.7 vulnerability
2021-03-03 00:00:00
hackerone
hackerone
Ruby: 'net/http': HTTP Header Injection in the set_content_type method
2021-04-19 09:25:39
f5
f5
K000133759 : Python vulnerability CVE-2020-26116
2023-05-08 00:00:00
K000133547 : Python urllib3 vulnerability CVE-2020-26137
2023-04-18 00:00:00
archlinux
archlinux
[ASA-202103-27] python2: multiple issues
2021-03-25 00:00:00
github
github
CRLF injection in urllib3
2021-06-18 18:46:43
alpinelinux
alpinelinux
CVE-2020-26137
2020-09-30 18:15:00
debian
debian
[SECURITY] [DLA 2456-1] python3.5 security update
2020-11-19 03:44:14

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

79.4%

JSON
Related for ALAS2-2021-1670
nessus66openvas51amazon3cloudlinux2redhat2almalinux1oraclelinux1prion3osv16gentoo2ubuntucve3mageia2debiancve3paloalto1cve3redhatcve2cbl_mariner2veracode2suse2photon4cloudfoundry4ibm5fedora6ubuntu6hackerone1f52archlinux1github1alpinelinux1debian1