stable

python36-3.6.11-1.fc32

FEDORA-2020-8bdd3fd7a4 created by churchyard 3 years ago for Fedora 32

Python 3.6.11

Python 3.6.11 is the latest security fix release of Python 3.6.

bpo-39073: Disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.
bpo-38576: Disallow control characters in hostnames in http.client, addressing CVE-2019-18348. Such potentially malicious header injection URLs now cause a InvalidURL to be raised.
bpo-39503: CVE-2020-8492: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager.

Also fix a regression with distutils.sysconfig.get_config_var('LIBPL') value in Fedora specific patches.

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2020-8bdd3fd7a4

This update has been submitted for testing by churchyard.

3 years ago

This update's test gating status has been changed to 'ignored'.

3 years ago

This update's test gating status has been changed to 'waiting'.

3 years ago

This update's test gating status has been changed to 'ignored'.

3 years ago

This update has been pushed to testing.

3 years ago

vstinner commented & provided feedback 3 years ago

karma

I confirm that python36-3.6.11-1.fc32.x86_64 fix the AbstractBasicAuthHandler vulnerability. I checked with https://pypi.org/project/check-python-vuln/ tool (which now says that all checked vulnerabilities are fixed).

I also confirm that LIBPL is fixed:

$ python3.6 -c "import distutils.sysconfig; print(distutils.sysconfig.get_config_var('LIBPL'))" /usr/lib64/python3.6/config-3.6m-x86_64-linux-gnu

$ python3.6 -c "import sysconfig; print(sysconfig.get_config_var('LIBPL'))" /usr/lib64/python3.6/config-3.6m-x86_64-linux-gnu

Note: I installed the package using "sudo dnf install https://kojipkgs.fedoraproject.org//packages/python36/3.6.11/1.fc32/x86_64/python36-3.6.11-1.fc32.x86_64.rpm". The dnf update didn't work yet.

BZ#1809065 CVE-2020-8492 python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS

BZ#1851008 distutils module: sysconfig.get_config_var('LIBPL') returns non existing directory

frantisekz commented & provided feedback 3 years ago

karma

Works fine (through tox for tests of my projects)

This update has been submitted for stable by bodhi.

3 years ago

This update has been pushed to stable.

3 years ago

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

python36-3.6.11-1.fc32

Settings

Unstable by Karma

-1

Stable by Karma

Stable by Time

7 days

Dates

submitted

3 years ago

in testing

3 years ago

in stable

3 years ago

BZ#1727276 CVE-2019-18348 python: CRLF injection via the host part of the url passed to urlopen()

BZ#1809065 CVE-2020-8492 python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS

BZ#1851008 distutils module: sysconfig.get_config_var('LIBPL') returns non existing directory

python36-3.6.11-1.fc32

Automated Test Results

ignored