SUSE-SU-2021:0794-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2021:0794-1

MEDIUM6.1

Security update for python

Published Mar 16, 2021

Modified 5 years ago

Fix available

Details

Description of the patch:

This update for python fixes the following issues:

python27 was upgraded to 2.7.18
CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator (bsc#1182379).

Affected Packages(15 packages)

libpython2_7-1_0

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

libpython2_7-1_0-32bit

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

python

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

python-32bit

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

python-base

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

python-base-32bit

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

python-curses

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

python-demo

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

python-doc

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

python-doc-pdf

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSS

Fixed in:

2.7.18-28.67.1

References

https://bugzilla.suse.com/1182379

https://lists.suse.com/pipermail/sle-security-updates/2021-March/008491.html

https://www.suse.com/security/cve/CVE-2019-18348/

https://www.suse.com/security/cve/CVE-2021-23336/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2021/suse-su-20210794-1/

CVSS Analysis

CVSS v3.1

6.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

6.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Upstream

CVE-2019-18348 CVE-2021-23336

Ecosystems(16)

SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS

Timeline

PublishedMar 16, 2021

ModifiedMar 16, 2021