Security update for python39 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:2940-1 Final 1 1 2021-09-03T07:22:33Z current 2021-09-03T07:22:33Z 2021-09-03T07:22:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python39 This update for python39 fixes the following issues: - CVE-2021-29921: Fixed improper input validation of octal string IP addresses (bsc#1185706). - Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858). - Stop providing 'python' symbol (bsc#1185588), which means python2 currently. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LSLJU26YTXZ6AGTZEW7EJ4Z7W6KRSZQF/ E-Mail link for openSUSE-SU-2021:2940-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1183858 SUSE Bug 1183858 https://bugzilla.suse.com/1185588 SUSE Bug 1185588 https://bugzilla.suse.com/1185706 SUSE Bug 1185706 https://www.suse.com/security/cve/CVE-2021-29921/ SUSE CVE CVE-2021-29921 page openSUSE Leap 15.3 python39-3.9.6-4.3.4 python39-32bit-3.9.6-4.3.4 python39-curses-3.9.6-4.3.4 python39-dbm-3.9.6-4.3.4 python39-idle-3.9.6-4.3.4 python39-tk-3.9.6-4.3.4 python39-3.9.6-4.3.4 as a component of openSUSE Leap 15.3 python39-32bit-3.9.6-4.3.4 as a component of openSUSE Leap 15.3 python39-curses-3.9.6-4.3.4 as a component of openSUSE Leap 15.3 python39-dbm-3.9.6-4.3.4 as a component of openSUSE Leap 15.3 python39-idle-3.9.6-4.3.4 as a component of openSUSE Leap 15.3 python39-tk-3.9.6-4.3.4 as a component of openSUSE Leap 15.3 In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses. CVE-2021-29921 openSUSE Leap 15.3:python39-3.9.6-4.3.4 openSUSE Leap 15.3:python39-32bit-3.9.6-4.3.4 openSUSE Leap 15.3:python39-curses-3.9.6-4.3.4 openSUSE Leap 15.3:python39-dbm-3.9.6-4.3.4 openSUSE Leap 15.3:python39-idle-3.9.6-4.3.4 openSUSE Leap 15.3:python39-tk-3.9.6-4.3.4 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LSLJU26YTXZ6AGTZEW7EJ4Z7W6KRSZQF/ https://www.suse.com/security/cve/CVE-2021-29921.html CVE-2021-29921 https://bugzilla.suse.com/1185706 SUSE Bug 1185706