Updated python packages fix security vulnerability

The mailcap module does not add escape characters into commands discovered in the system mailcap file. CVE-2015-20107 Allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. CVE-2021-4189 The urlparse method does not...

Important Photon OS Security Update - PHSA-2022-3.0-0463

Updates of 'python3', 'python2' packages of Photon OS have been released...

azureml-designer-classic-modules (>=0.0.118, <=0.0.129), dimepy (1.0.1) +15 more potentially affected by CVE-2022-21797 via joblib (0.14.0)

joblib PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on joblib and may be impacted: - azureml-designer-classic-modules =0.0.118, =1.0.0rc1, =0.0.1, =2019.0.2, =0.0.3, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2022-21797 Source...

abba-python (>=0.1.6, <=0.3.0), abmarl (>=0.1.1, <=0.1.3) +798 more potentially affected by CVE-2022-21729 via tensorflow (>=1.0.1, <=2.5.2)

tensorflow PYPI version =1.0.1, =0.1.6, =0.1.1, =1.0.1, =1.0.0, =1.2.0, =1.1.2, =0.0.1, =0.3.26, =1.1.5, =0.0.1, =2.1.0, =3.0.21 and more Source cves: CVE-2022-21729 Source advisory: MEND:CVE-2022-21729...

azureml-designer-classic-modules (>=0.0.127, <=0.0.129), azureml-designer-cv-modules (>=0.0.8, <=0.0.10) +17 more potentially affected by CVE-2022-22817 via pillow (7.1.0)

pillow PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - azureml-designer-classic-modules =0.0.127, =0.0.8, =0.0.10, =0.0.7, =0.0.7, =0.0.2, =0.3.1, =0.1.1, =0.0.2, =0.0.1, =0.0.4, =0.0.3, =0.1.0 - qweb...

A week in security (Nov 15 – Nov 21)

Last week on Malwarebytes Labs Instagram’s memorialize feature abused to memorialize…Instagram’s boss Evasive manoeuvres: HTML smuggling explained FBI server hijacked to send up to 100,000 bogus attack mails New Mac malware raises more questions about Apple’s security patching SharkBot Android...

11 Malicious PyPI Python Libraries Caught Stealing Discord Tokens and Installing Shells

Cybersecurity researchers have uncovered as many as 11 malicious Python packages that have been cumulatively downloaded more than 41,000 times from the Python Package Index PyPI repository, and could be exploited to steal Discord access tokens, passwords, and even stage dependency confusion...

Antilles code issues and vulnerabilities

Lenovo Antilles is an open-source infrastructure management software for high performance computing Hpc from Lenovo, China. A security vulnerability exists in versions of Antilles open-source software prior to 1.0.1, which stems from the non-existence of packages listed in requirements.txt in the...

CentOS 8 : python27:2.7 (CESA-2021:4151)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4151 advisory. - python: Unsafe use of eval on data retrieved via HTTP in the test suite CVE-2020-27619 - python-jinja2: ReDoS vulnerability in the urlize filter...

abmarl (>=0.1.1, <=0.1.3), accuinsight (>=1.0.47, <=3.0.0) +417 more potentially affected by CVE-2021-41218 via tensorflow (>=2.0.0, <=2.4.2)

tensorflow PYPI version =2.0.0, =0.1.1, =1.0.47, =1.0.0, =1.2.0, =1.1.5, =0.0.1, =2.1.0, =0.5.6, =0.5.0, =0.1.0, =0.1.8 and more Source cves: CVE-2021-41218 Source advisory: OSV:GHSA-9CRF-C6QR-R273...

MGASA-2021-0457 Updated python packages fix security vulnerability

Denial of service when identifying crafted invalid RFCs Security fix for CVE-2021-3737: python client can enter an infinite loop on a 100 Continue response from the server...

Updated python packages fix security vulnerability

Denial of service when identifying crafted invalid RFCs Security fix for CVE-2021-3737: python client can enter an infinite loop on a 100 Continue response from the server...

abba-python (>=0.1.6, <=0.3.0), accuinsight (>=1.0.1, <=3.0.0) +672 more potentially affected by CVE-2021-37635 via tensorflow (>=1.0.1, <=2.3.2)

tensorflow PYPI version =1.0.1, =0.1.6, =1.0.1, =1.2.0, =1.1.2, =0.0.1, =0.3.26, =0.0.1, =0.2.0, =0.3.1, =0.5.0, =0.8.0 and more Source cves: CVE-2021-37635 Source advisory: MEND:CVE-2021-37635...

MGASA-2021-0386 Updated python3 packages fix security vulnerabilities

Update python3 to 3.8.11 to fix several security issues. Fixes in 3.8.10 are also included. Bundled pip and setuptools were updated in 3.8.11 so python-pip needs to be updated to 21.1.3 and python-setuptools to 56.2.0 at the same time. Also, we fix the following issue: In Python before 3.9.5, the...

Pip input validation vulnerability

Pip is a set of tools for installing and managing Python packages. An input validation error vulnerability exists in python pip, which could be exploited by a remote attacker to install a different revision on the repository...

MGASA-2021-0327 Updated python packages fix security vulnerability

Updated python packages fix security vulnerability: In Python's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP CVE-2020-27619...

abba-python (>=0.1.6, <=0.3.0), adversal-embedding (>=0.0.1, <=0.0.7) +52 more potentially affected by CVE-2021-29614 via tensorflow (1.15.0)

tensorflow PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - abba-python =0.1.6, =0.0.1, =0.2.6, =2023.1.0, =0.2.11, =0.0.4, =0.10.0, =0.10.1 - deepaclive 0.1.0 and more Source cves: CVE-2021-29614...

adpred (>=1.1.2, <=1.2.7), aix360 (>=0.2.0, <=0.2.1) +73 more potentially affected by CVE-2021-29601 via tensorflow (1.14.0)

tensorflow PYPI version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - adpred =1.1.2, =0.2.0, =1.0.4, =0.1.1, =1.0.2, =0.0.4, =0.1.0, =0.92.0, =0.12.0, =0.22.0 and more Source cves: CVE-2021-29601 Source...

alfabet (0.0.5), alibi (>=0.3.1, <=0.5.1) +67 more potentially affected by CVE-2021-29580 via tensorflow (1.15.5)

tensorflow PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - alfabet 0.0.5 - alibi =0.3.1, =0.1.0, =1.0.2, =0.1.0a3, =0.1.1, =0.0.1, =0.1.14, =0.2.0, =0.0.1, =0.1.0, =0.7.0 and more Source cves:...

python27:2.7 security and bug fix update

An update is available for python-pymongo, python2-rpm-macros, python-sqlalchemy, python-backports, python-docutils, pytest, python-psycopg2, python-lxml, python-PyMySQL, python-urllib3, PyYAML, python-pytest-mock, python-attrs, python-jinja2, python-docs, python-requests, python-mock,...