[SECURITY] [DLA 1835-1] python3.4 security update

Package : python3.4 Version : 3.4.2-1+deb8u3 CVE ID : CVE-2018-14647 CVE-2019-9636 CVE-2019-9740 CVE-2019-9947 Debian Bug : 921039 924072 Multiple vulnerabilities were discovered in Python, an interactive high-level object-oriented language, including CVE-2018-14647 Pythons elementtree C...

[SECURITY] [DLA 1834-1] python2.7 security update

Package : python2.7 Version : 2.7.9-2+deb8u3 CVE ID : CVE-2018-14647 CVE-2019-5010 CVE-2019-9636 CVE-2019-9740 CVE-2019-9947 CVE-2019-9948 CVE-2019-10160 Debian Bug : 921039 921040 924073 Multiple vulnerabilities were discovered in Python, an interactive high-level object-oriented language,...

Medium: python27

Issue Overview: Python 2.7.x through 2.7.16 is affected by: Improper Handling of Unicode Encoding with an incorrect netloc during NFKC normalization. The impact is: Information disclosure credentials, cookies, etc. that are cached against a given hostname. The components are: urllib.parse.urlspli...

Debian DLA-1834-1 : python2.7 security update

Multiple vulnerabilities were discovered in Python, an interactive high-level object-oriented language, including CVE-2018-14647 Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against...

Debian DLA-1828-1 : python-urllib3 security update

A vulnerability was discovered in python-urllib3, an HTTP library with thread-safe connection pooling, whereby an attacker can inject CRLF characters in the request parameter. For Debian 8 'Jessie', this problem has been fixed in version 1.9.1-3+deb8u1. We recommend that you upgrade your...

[SECURITY] [DLA 1828-1] python-urllib3 security update

Package : python-urllib3 Version : 1.9.1-3+deb8u1 CVE ID : CVE-2019-11236 Debian Bug : 927172 A vulnerability was discovered in python-urllib3, an HTTP library with thread-safe connection pooling, whereby an attacker can inject CRLF characters in the request parameter. For Debian 8 "Jessie", this...

RHEL 8 : go-toolset:rhel8 (RHSA-2019:1519)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1519 advisory. The go-toolset:rhel8 module provides Go Toolset, a compiler toolset for building applications using the Go language and compiler suite. Security Fixe...

golang: CRLF injection in net/http

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command...

Moderate: Red Hat Security Advisory: go-toolset:rhel8 security update

An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2019-12387

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

CRLF Injection

Twisted is vulnerable to CRLF injection. It does not validate URL in the request sent by HTTP clients, allowing an attacker to inject malicious characters such as CRLF...

Twisted CRLF Injection

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

CVE-2019-12387

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

CVE-2019-12387

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

Design/Logic Flaw

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

PYSEC-2019-128

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

CVE-2019-12387

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

CVE-2019-12387

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...

PT-2019-2639 · Twisted Matrix Laboratories +5 · Twisted +5

Name of the Vulnerable Software and Affected Versions: Twisted versions prior to 19.2.1 Description: The issue exists due to insufficient input validation in the twisted.web component of the Twisted network framework. This allows a remote attacker to impact the confidentiality and integrity of...

RHEL 7 : go-toolset-1.11-golang (RHSA-2019:1300)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1300 advisory. The golang packages provide the Go programming language compiler. Security Fixes: golang: CRLF injection in net/http CVE-2019-9741 For more details...