SUSE-SU-2022:2249-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2022:2249-1

HIGH7.1

Security update for python

Published Jul 4, 2022

Modified 3 years ago

Fix available

Details

Description of the patch:

This update for python fixes the following issues:

CVE-2015-20107: avoid command injection in the mailcap module (bsc#1198511).

Affected Packages(15 packages)

libpython2_7-1_0

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

libpython2_7-1_0-32bit

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

python

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

python-32bit

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

python-base

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

python-base-32bit

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

python-curses

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

python-demo

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

python-doc

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

python-doc-pdf

SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE OpenStack Cloud 8

Fixed in:

2.7.18-28.87.1

References

https://bugzilla.suse.com/1198511

https://lists.suse.com/pipermail/sle-security-updates/2022-July/011384.html

https://www.suse.com/security/cve/CVE-2015-20107/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2022/suse-su-20222249-1/

CVSS Analysis

CVSS v3.1

7.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

HighI:H

Availability

LowA:L

7.1/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Upstream

Ecosystems(6)

SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE OpenStack Cloud 8

Timeline

PublishedJul 4, 2022

ModifiedJul 4, 2022