Update legacy Python to 2.7.16. Most significant improvement is that is builds against OpenSSL 1.1.1. See upstream release announcement and changelog (+ rc1 changelog).

Fixes the following CVEs:

  • CVE-2019-5010 Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet of Cisco.
  • CVE-2013-1752: Change use of readline() in imaplib.IMAP4_SSL to limit line length.

(CVE-2018-14647 is listed in upstream changelog, but it was already backported in Fedora.)

Note that Python 2 is deprecated in Fedora 30 and users are advised to switch to Python 3. Upstream support of Python 2 ends on 2020-01-01.

How to install

sudo dnf upgrade --advisory=FEDORA-2019-0c91ce7b3c

This update has been submitted for testing by churchyard.

2 years ago

python2-2.7.16-1.fc30 ejected from the push because "Cannot find relevant tag for python2-2.7.16-1.fc30. None of ['f30-updates-candidate', 'f30-updates-testing-pending'] are in ['f22-updates-candidate', 'f21-updates-candidate', 'f25-updates-candidate', 'f24-updates-candidate', 'f23-updates-candidate', 'f28-updates-candidate', 'f26-updates-candidate', 'dist-6E-epel-testing-candidate', 'epel7-testing-candidate', 'dist-5E-epel-testing-candidate', 'f27-modular-updates-candidate', 'f28-modular-updates-candidate', 'f29-updates-candidate', 'f29-modular-updates-candidate', 'f29-container-updates-candidate', 'f28-container-updates-candidate', 'f29-flatpak-updates-candidate', 'f27-updates-candidate']."

2 years ago

This update has been submitted for testing by mohanboddu.

2 years ago

This update has been pushed to testing.

2 years ago
User Icon pwalter commented & provided feedback 2 years ago
karma

Works

churchyard edited this update.

New build(s):

  • python2-docs-2.7.16-1.fc30

Karma has been reset.

2 years ago

This update has been submitted for testing by churchyard.

2 years ago
User Icon churchyard commented & provided feedback 2 years ago

I forgot to add docs, so now the karma is reset. @pwalter if you could readd it, I would appreciate it. Thanks.

This update has been pushed to testing.

2 years ago
User Icon renault commented & provided feedback 2 years ago
karma

No regressions found

User Icon danniel commented & provided feedback 2 years ago
karma

works

User Icon cserpentis commented & provided feedback 2 years ago
karma

works for me

This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes

2 years ago

This update has been submitted for batched by churchyard.

2 years ago

This update has been submitted for stable by bodhi.

2 years ago

This update has been pushed to stable.

2 years ago

Please login to add feedback.

Metadata
Type
security
Severity
medium
Karma
3
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-2
Stable by Karma
4
Stable by Time
disabled
Dates
submitted
2 years ago
in testing
2 years ago
in stable
2 years ago
modified
2 years ago
BZ#1643450 Python 2 is built against an old OpenSSL (1.0.1) while 1.1.1 is available in F29
0
0

Automated Test Results