Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
centosCentOS ProjectCESA-2020:3888
HistoryOct 20, 2020 - 6:48 p.m.

python3 security update

2020-10-2018:48:39
CentOS Project
lists.centos.org
354

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

0.008 Low

EPSS

Percentile

81.9%

JSON

CentOS Errata and Security Advisory CESA-2020:3888

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • python: XSS vulnerability in the documentation XML-RPC server in server_title field (CVE-2019-16935)

  • python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS (CVE-2020-8492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2020-October/032880.html

Affected packages:
python3
python3-debug
python3-devel
python3-idle
python3-libs
python3-test
python3-tkinter

Upstream details at:
https://access.redhat.com/errata/RHSA-2020:3888

OSVersionArchitecturePackageVersionFilename
CentOS7i686python3< 3.6.8-17.el7python3-3.6.8-17.el7.i686.rpm
CentOS7x86_64python3< 3.6.8-17.el7python3-3.6.8-17.el7.x86_64.rpm
CentOS7i686python3-debug< 3.6.8-17.el7python3-debug-3.6.8-17.el7.i686.rpm
CentOS7x86_64python3-debug< 3.6.8-17.el7python3-debug-3.6.8-17.el7.x86_64.rpm
CentOS7i686python3-devel< 3.6.8-17.el7python3-devel-3.6.8-17.el7.i686.rpm
CentOS7x86_64python3-devel< 3.6.8-17.el7python3-devel-3.6.8-17.el7.x86_64.rpm
CentOS7i686python3-idle< 3.6.8-17.el7python3-idle-3.6.8-17.el7.i686.rpm
CentOS7x86_64python3-idle< 3.6.8-17.el7python3-idle-3.6.8-17.el7.x86_64.rpm
CentOS7i686python3-libs< 3.6.8-17.el7python3-libs-3.6.8-17.el7.i686.rpm
CentOS7x86_64python3-libs< 3.6.8-17.el7python3-libs-3.6.8-17.el7.x86_64.rpm
Rows per page:
1-10 of 141

Related

oraclelinux 3
redhat 4
nessus 73
almalinux 1
ibm 7
redhatcve 2
symantec 1
cve 2
hackerone 1
amazon 6
centos 1
ubuntucve 2
openvas 48
osv 8
prion 2
debiancve 2
f5 1
veracode 2
alpinelinux 2
fedora 12
freebsd 3
gentoo 1
cloudfoundry 2
debian 1
suse 7
ubuntu 5
oraclelinux
oraclelinux
python3 security update
2020-10-06 00:00:00
python3 security and bug fix update
2020-11-10 00:00:00
python security update
2020-10-06 00:00:00
redhat
redhat
(RHSA-2020:3888) Moderate: python3 security update
2020-09-29 07:40:56
(RHSA-2020:4433) Moderate: python3 security and bug fix update
2020-11-03 12:04:08
(RHSA-2020:3911) Moderate: python security update
2020-09-29 07:42:55
nessus
nessus
CentOS 7 : python3 (CESA-2020:3888)
2020-10-20 00:00:00
Oracle Linux 7 : python3 (ELSA-2020-3888)
2020-10-07 00:00:00
Scientific Linux Security Update : python3 on SL7.x x86_64 (20201001)
2020-10-21 00:00:00
almalinux
almalinux
Moderate: python3 security and bug fix update
2020-11-03 12:04:08
ibm
ibm
Security Bulletin: A vulnerability in Python affects IBM Operations Analytics Predictive Insights (CVE-2019-16935)
2020-02-28 17:01:53
Security Bulletin: Python vulnerability in IBM Tivoli Application Dependency Discovery Manager (CVE-2019-16935)
2020-09-16 16:19:31
Security Bulletin: Vulnerabilities in Python affect OS Image for RedHat bundled with Cloud Pak System
2021-07-19 12:06:52
redhatcve
redhatcve
CVE-2019-16935
2020-03-29 02:10:40
CVE-2020-8492
2020-03-02 11:41:02
symantec
symantec
Python CVE-2019-16935 CRLF Multiple Cross Site Scripting Vulnerabilities
2019-09-30 00:00:00
cve
cve
CVE-2019-16935
2019-09-28 02:15:00
CVE-2020-8492
2020-01-30 19:15:00
hackerone
hackerone
Internet Bug Bounty: A reflected XSS in python/Lib/DocXMLRPCServer.py
2019-10-01 14:21:18
amazon
amazon
Medium: python27, python35, python36
2020-02-10 23:33:00
Medium: python, python3
2020-07-31 19:22:00
Medium: python26
2020-07-27 23:54:00
centos
centos
python, tkinter security update
2020-10-20 18:48:10
ubuntucve
ubuntucve
CVE-2019-16935
2019-09-28 00:00:00
CVE-2020-8492
2020-01-30 00:00:00
openvas
openvas
Python < 2.7.17, 3.5.x < 3.5.8, 3.6.x < 3.6.10, 3.7.x < 3.7.5 XSS Vulnerability (bpo-38243) - Linux
2021-09-12 00:00:00
Python < 2.7.17, 3.x < 3.5.8, 3.6.x < 3.6.10, 3.7.x < 3.7.5 XSS Vulnerability (bpo-38243) - Windows
2021-09-12 00:00:00
Python < 2.7.17, 3.x < 3.5.8, 3.6.x < 3.6.10, 3.7.x < 3.7.5 XSS Vulnerability (bpo-38243) - Mac OS X
2021-09-12 00:00:00
osv
osv
Reflected XSS in DocXMLRPCServer
2019-09-28 01:33:02
CVE-2019-16935
2019-09-28 02:15:10
Regular Expression Denial of Service in http.cookiejar
2019-11-14 00:00:00
prion
prion
Input validation
2019-09-28 02:15:00
Code injection
2020-01-30 19:15:00
debiancve
debiancve
CVE-2019-16935
2019-09-28 02:15:00
CVE-2020-8492
2020-01-30 19:15:00
f5
f5
K000134818 : Python XML RPC vulnerability CVE-2019-16935
2023-05-26 00:00:00
veracode
veracode
Cross-Site Scripting (XSS)
2020-05-10 23:24:03
Denial Of Service (DoS)
2020-08-06 21:33:11
alpinelinux
alpinelinux
CVE-2019-16935
2019-09-28 02:15:00
CVE-2020-8492
2020-01-30 19:15:00
fedora
fedora
[SECURITY] Fedora 31 Update: python38-3.8.3-1.fc31
2020-05-29 02:27:10
[SECURITY] Fedora 32 Update: python3-3.8.3-1.fc32
2020-05-26 03:14:58
[SECURITY] Fedora 30 Update: python36-3.6.10-1.fc30
2020-01-12 01:16:42
freebsd
freebsd
Python -- Regular Expression DoS attack against client
2019-11-17 00:00:00
tauthon -- Regular Expression Denial of Service
2020-01-30 00:00:00
Python -- multiple vulnerabilities
2019-10-24 00:00:00
gentoo
gentoo
Python: Denial of service
2020-05-14 00:00:00
cloudfoundry
cloudfoundry
USN-4151-1: Python vulnerabilities | Cloud Foundry
2019-11-06 00:00:00
USN-4333-1: Python vulnerabilities | Cloud Foundry
2020-05-14 00:00:00
debian
debian
[SECURITY] [DLA 2628-1] python2.7 security update
2021-04-17 19:31:24
suse
suse
Security update for python3 (moderate)
2019-11-05 00:00:00
Security update for python3 (moderate)
2019-11-09 00:00:00
Security update for python3 (moderate)
2020-03-01 00:00:00
ubuntu
ubuntu
Python vulnerabilities
2019-10-09 00:00:00
Python vulnerabilities
2019-10-10 00:00:00
Python vulnerabilities
2020-04-21 00:00:00

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

0.008 Low

EPSS

Percentile

81.9%

JSON
Related for CESA-2020:3888
oraclelinux3redhat4nessus73almalinux1ibm7redhatcve2symantec1cve2hackerone1amazon6centos1ubuntucve2openvas48osv8prion2debiancve2f51veracode2alpinelinux2fedora12freebsd3gentoo1cloudfoundry2debian1suse7ubuntu5