Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
centosCentOS ProjectCESA-2020:0851
HistoryMar 25, 2020 - 7:10 p.m.

python security update

2020-03-2519:10:05
CentOS Project
lists.centos.org
1412
centos
virtualenv
python-urllib3
python-requests
cve-2018-20060
cve-2019-11236
cve-2018-18074
security update
redhat

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.005

Percentile

76.7%

JSON

CentOS Errata and Security Advisory CESA-2020:0851

The virtualenv tool creates isolated Python environments. The virtualenv tool is a successor to workingenv, and an extension of virtual-python.

Security Fix(es):

  • python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure (CVE-2018-20060)

  • python-urllib3: CRLF injection due to not encoding the ‘\r\n’ sequence leading to possible attack on internal service (CVE-2019-11236)

  • python-requests: Redirect from HTTPS to HTTP does not remove Authorization header (CVE-2018-18074)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2020-March/085804.html

Affected packages:
python-virtualenv

Upstream details at:
https://access.redhat.com/errata/RHSA-2020:0851

OSVersionArchitecturePackageVersionFilename
CentOS7noarchpython-virtualenv< 15.1.0-4.el7_7python-virtualenv-15.1.0-4.el7_7.noarch.rpm

Related

nessus 82
openvas 36
redhat 8
oraclelinux 8
amazon 6
centos 3
freebsd 2
almalinux 2
mageia 2
ubuntu 4
osv 10
rocky 2
debian 2
suse 2
prion 2
f5 2
ubuntucve 2
fedora 6
kitploit 1
redhatcve 2
cvelist 2
github 3
debiancve 2
cve 2
veracode 2
nvd 2
huntr 1
ibm 1
nessus
nessus
Oracle Linux 7 : python-virtualenv (ELSA-2020-2081)
2023-09-07 00:00:00
NewStart CGSL CORE 5.04 / MAIN 5.04 : python-virtualenv Multiple Vulnerabilities (NS-SA-2020-0044)
2020-09-07 00:00:00
Scientific Linux Security Update : python-virtualenv on SL7.x (noarch) (20200317)
2020-03-18 00:00:00
openvas
openvas
CentOS: Security Advisory for python-virtualenv (CESA-2020:0851)
2020-03-26 00:00:00
CentOS: Security Advisory for python3-pip (CESA-2020:0850)
2020-03-26 00:00:00
Mageia: Security Advisory (MGASA-2019-0258)
2022-01-28 00:00:00
redhat
redhat
(RHSA-2020:2081) Moderate: python-virtualenv security update
2020-05-12 14:03:20
(RHSA-2020:0851) Moderate: python-virtualenv security update
2020-03-17 13:10:32
(RHSA-2020:2068) Moderate: python-pip security update
2020-05-12 14:03:16
oraclelinux
oraclelinux
python-virtualenv security update
2020-03-18 00:00:00
python-virtualenv security update
2020-05-19 00:00:00
python-pip security update
2020-05-19 00:00:00
amazon
amazon
Medium: python-virtualenv
2020-04-20 20:48:00
Low: python-requests
2019-10-21 18:01:00
Low: python-urllib3
2019-05-16 21:46:00
centos
centos
python3 security update
2020-03-18 19:33:57
python security update
2019-08-30 04:04:34
python security update
2019-08-30 04:03:34
freebsd
freebsd
urllib3 -- multiple vulnerabilities
2018-12-11 00:00:00
www/py-requests -- Information disclosure vulnerability
2018-06-27 00:00:00
almalinux
almalinux
Moderate: python27:2.7 security, bug fix, and enhancement update
2020-04-28 08:55:59
python-requests bug fix update
2019-11-05 20:50:57
mageia
mageia
Updated python-urllib3 packages fix security vulnerability
2019-09-07 00:09:08
Updated python-requests packages fix security vulnerability
2018-12-03 01:15:20
ubuntu
ubuntu
urllib3 vulnerabilities
2019-05-21 00:00:00
Requests vulnerability
2018-10-22 00:00:00
Requests vulnerability
2018-10-15 00:00:00
osv
osv
Moderate: python27:2.7 security, bug fix, and enhancement update
2020-04-28 08:55:59
Moderate: python27:2.7 security, bug fix, and enhancement update
2020-04-28 08:55:59
python-urllib3 - security update
2021-06-15 00:00:00
rocky
rocky
python27:2.7 security, bug fix, and enhancement update
2020-04-28 08:55:59
python-requests bug fix update
2019-11-05 20:50:57
debian
debian
[SECURITY] [DLA 2686-1] python-urllib3 security update
2021-06-15 18:34:44
[SECURITY] [DLA 1828-1] python-urllib3 security update
2019-06-20 11:32:24
suse
suse
Security update for python-urllib3 (moderate)
2019-09-14 00:00:00
Security update for python-requests (moderate)
2019-07-20 00:00:00
prion
prion
Authorization
2018-10-09 17:29:00
Authorization
2018-12-11 17:29:00
f5
f5
K000133652 : Python vulnerability CVE-2018-18074
2023-04-27 00:00:00
K000133668 : Python urllib3 vulnerability CVE-2018-20060
2023-04-27 00:00:00
ubuntucve
ubuntucve
CVE-2018-18074
2018-10-09 00:00:00
CVE-2018-20060
2018-12-11 00:00:00
fedora
fedora
[SECURITY] Fedora 29 Update: python-requests-2.20.0-1.fc29
2018-11-06 22:11:30
[SECURITY] Fedora 30 Update: python-urllib3-1.24.2-1.fc30
2019-04-27 21:35:01
[SECURITY] Fedora 27 Update: python-requests-2.20.0-1.fc27
2018-11-14 02:56:22
kitploit
kitploit
Packj - Large-Scale Security Analysis Platform To Detect Malicious/Risky Open-Source Packages
2022-08-10 12:30:00
redhatcve
redhatcve
CVE-2018-20060
2021-08-22 13:20:42
CVE-2018-18074
2020-04-03 01:55:49
cvelist
cvelist
CVE-2018-18074
2018-10-09 15:00:00
CVE-2018-20060
2018-12-11 17:00:00
github
github
Insufficiently Protected Credentials in Requests
2018-10-29 19:06:46
Exposure of Sensitive Information to an Unauthorized Actor in urllib3
2018-12-12 15:52:07
Improper Neutralization of CRLF Sequences in urllib3 library for Python
2022-05-13 01:09:23
debiancve
debiancve
CVE-2018-18074
2018-10-09 17:29:01
CVE-2018-20060
2018-12-11 17:29:00
cve
cve
CVE-2018-18074
2018-10-09 17:29:01
CVE-2018-20060
2018-12-11 17:29:00
veracode
veracode
Information Disclosure
2018-10-10 02:26:19
Information Disclosure
2018-12-12 03:50:22
nvd
nvd
CVE-2018-18074
2018-10-09 17:29:01
CVE-2018-20060
2018-12-11 17:29:00
huntr
huntr
Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
2022-02-12 17:07:46
ibm
ibm
Security Bulletin: A vulnerability in urllib3 affects Data Replication on Cloud Pak for Data
2024-06-28 12:43:29

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.005

Percentile

76.7%

JSON
Related for CESA-2020:0851
nessus82openvas36redhat8oraclelinux8amazon6centos3freebsd2almalinux2mageia2ubuntu4osv10rocky2debian2suse2prion2f52ubuntucve2fedora6kitploit1redhatcve2cvelist2github3debiancve2cve2veracode2nvd2huntr1ibm1