SUSE SLES12 Security Update : python (SUSE-SU-2020:3121-1)

This update for python fixes the following issues : CVE-2020-26116: Fixed CRLF injection via HTTP request method bsc1177211. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and...

NewStart CGSL CORE 5.05 / MAIN 5.05 : python-virtualenv Multiple Vulnerabilities (NS-SA-2020-0118)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python-virtualenv packages installed that are affected by multiple vulnerabilities: - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. CVE-2019-112...

SUSE SLES12 Security Update : python36 (SUSE-SU-2020:3563-1)

This update for python36 fixes the following issues : Update to 3.6.12, including the following fixes : Fixed a directory traversal in downloadhttpurl bsc1176262 CVE-2019-20916 Fixed CRLF injection via HTTP request method in httplib/http.client bsc1177211 CVE-2020-26116 Fixed possible infinite lo...

NewStart CGSL CORE 5.05 / MAIN 5.05 : python-pip Multiple Vulnerabilities (NS-SA-2020-0112)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python-pip packages installed that are affected by multiple vulnerabilities: - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of...

Updated python and python3 packages fix security vulnerabilities

It was discovered that incorrectly handled certain ZIP files. An attacker could possibly use this issue to cause a denial of service CVE-2019-9674. It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this...

MGASA-2020-0451 Updated python and python3 packages fix security vulnerabilities

It was discovered that incorrectly handled certain ZIP files. An attacker could possibly use this issue to cause a denial of service CVE-2019-9674. It was discovered that Python documentation had a misleading information. A security issue could be possibly caused by wrong assumptions of this...

CRLF Injection

wget is vulnerable to CRLF injection. The urlparse function in url.c allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL...

SUSE-SU-2020:3624-1 Security update for crowbar-openstack, grafana, influxdb, python-urllib3

This update for crowbar-openstack, grafana, influxdb, python-urllib3 contains the following fixes: Security fixes included in this update: openstack-glance - CVE-2016-8611: Added rate limiting for glance api bnc1005886 grafana - CVE-2020-24303: Fixed an XSS via a query alias for the ElasticSearch...

Security Bulletin: Vulnerability in Urllib3 affects IBM Spectrum Protect Container and Microsoft File Systems Agents (CVE-2020-26137)

Summary Urllib3 is vulnerable to CRLF injection which could allow a remote attacker to perform cross-site scripting, cache poisoning, or session hijacking attacks. This vulnerability may affect the IBM Spectrum Protect Plus Container agent for Kubernetes and the IBM Spectrum Protect Plus Microsof...

SUSE-SU-2020:3563-1 Security update for python36

This update for python36 fixes the following issues: Update to 3.6.12, including the following fixes: - Fixed a directory traversal in downloadhttpurl bsc1176262 CVE-2019-20916 - Fixed CRLF injection via HTTP request method in httplib/http.client bsc1177211 CVE-2020-26116 - Fixed possible infinit...

U.S. General Services Administration: CRLF INJECTION

Vulnerable url - https://www.epay.fas.gsa.gov/%0D%0ASet-Cookie:crlfinjection=crlfinjection Impact an attacker can set new header...

USN-4581-1: Python vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that Python incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform CRLF injection. CVEs...

CentOS 7 : fence-agents (RHSA-2020:5003)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5003 advisory. - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request could change request headers and body, send...

Debian: Security Advisory (DLA-2456-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

fence security update

CentOS Errata and Security Advisory CESA-2020:5003 An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

resource security update

CentOS Errata and Security Advisory CESA-2020:5004 An update for resource-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

Amazon Linux AMI : python27, python34, python35 (ALAS-2020-1454)

The version of python27 installed on the remote host is prior to 2.7.18-2.140. The version of python34 installed on the remote host is prior to 3.4.10-1.53. The version of python35 installed on the remote host is prior to 3.5.10-1.29. It is, therefore, affected by a vulnerability as referenced in...

RHEL 7 : fence-agents (RHSA-2020:5003)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5003 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function

A flaw was found in python-httplib2. An attacker controlling an unescaped part of uri for httplib2.Http.request could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenatio...

Low: Red Hat Security Advisory: fence-agents security and bug fix update

An update for fence-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...