Security update for python SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:1091-1 Final 1 1 2022-04-01T14:59:44Z current 2022-04-01T14:59:44Z 2022-04-01T14:59:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python This update for python fixes the following issues: - CVE-2022-0391: Fixed URL sanitization containing ASCII newline and tabs in urlparse (bsc#1195396). - CVE-2021-4189: Fixed ftplib not to trust the PASV response (bsc#1194146). - CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2022-1091,openSUSE-SLE-15.4-2022-1091 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ULIK4RFHGHTVVWROQ6NTBBB4JWOGWYD6/ E-Mail link for openSUSE-SU-2022:1091-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1175619 SUSE Bug 1175619 https://bugzilla.suse.com/1186819 SUSE Bug 1186819 https://bugzilla.suse.com/1194146 SUSE Bug 1194146 https://bugzilla.suse.com/1195396 SUSE Bug 1195396 https://www.suse.com/security/cve/CVE-2021-3572/ SUSE CVE CVE-2021-3572 page https://www.suse.com/security/cve/CVE-2021-4189/ SUSE CVE CVE-2021-4189 page https://www.suse.com/security/cve/CVE-2022-0391/ SUSE CVE CVE-2022-0391 page openSUSE Leap 15.3 libpython2_7-1_0-2.7.18-150000.38.2 libpython2_7-1_0-32bit-2.7.18-150000.38.2 python-2.7.18-150000.38.1 python-32bit-2.7.18-150000.38.1 python-base-2.7.18-150000.38.2 python-base-32bit-2.7.18-150000.38.2 python-curses-2.7.18-150000.38.1 python-demo-2.7.18-150000.38.1 python-devel-2.7.18-150000.38.2 python-doc-2.7.18-150000.38.1 python-doc-pdf-2.7.18-150000.38.1 python-gdbm-2.7.18-150000.38.1 python-idle-2.7.18-150000.38.1 python-tk-2.7.18-150000.38.1 python-xml-2.7.18-150000.38.2 libpython2_7-1_0-2.7.18-150000.38.2 as a component of openSUSE Leap 15.3 libpython2_7-1_0-32bit-2.7.18-150000.38.2 as a component of openSUSE Leap 15.3 python-2.7.18-150000.38.1 as a component of openSUSE Leap 15.3 python-32bit-2.7.18-150000.38.1 as a component of openSUSE Leap 15.3 python-base-2.7.18-150000.38.2 as a component of openSUSE Leap 15.3 python-base-32bit-2.7.18-150000.38.2 as a component of openSUSE Leap 15.3 python-curses-2.7.18-150000.38.1 as a component of openSUSE Leap 15.3 python-demo-2.7.18-150000.38.1 as a component of openSUSE Leap 15.3 python-devel-2.7.18-150000.38.2 as a component of openSUSE Leap 15.3 python-doc-2.7.18-150000.38.1 as a component of openSUSE Leap 15.3 python-doc-pdf-2.7.18-150000.38.1 as a component of openSUSE Leap 15.3 python-gdbm-2.7.18-150000.38.1 as a component of openSUSE Leap 15.3 python-idle-2.7.18-150000.38.1 as a component of openSUSE Leap 15.3 python-tk-2.7.18-150000.38.1 as a component of openSUSE Leap 15.3 python-xml-2.7.18-150000.38.2 as a component of openSUSE Leap 15.3 A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. CVE-2021-3572 openSUSE Leap 15.3:libpython2_7-1_0-2.7.18-150000.38.2 openSUSE Leap 15.3:libpython2_7-1_0-32bit-2.7.18-150000.38.2 openSUSE Leap 15.3:python-2.7.18-150000.38.1 openSUSE Leap 15.3:python-32bit-2.7.18-150000.38.1 openSUSE Leap 15.3:python-base-2.7.18-150000.38.2 openSUSE Leap 15.3:python-base-32bit-2.7.18-150000.38.2 openSUSE Leap 15.3:python-curses-2.7.18-150000.38.1 openSUSE Leap 15.3:python-demo-2.7.18-150000.38.1 openSUSE Leap 15.3:python-devel-2.7.18-150000.38.2 openSUSE Leap 15.3:python-doc-2.7.18-150000.38.1 openSUSE Leap 15.3:python-doc-pdf-2.7.18-150000.38.1 openSUSE Leap 15.3:python-gdbm-2.7.18-150000.38.1 openSUSE Leap 15.3:python-idle-2.7.18-150000.38.1 openSUSE Leap 15.3:python-tk-2.7.18-150000.38.1 openSUSE Leap 15.3:python-xml-2.7.18-150000.38.2 moderate 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ULIK4RFHGHTVVWROQ6NTBBB4JWOGWYD6/ https://www.suse.com/security/cve/CVE-2021-3572.html CVE-2021-3572 https://bugzilla.suse.com/1186819 SUSE Bug 1186819 A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible. CVE-2021-4189 openSUSE Leap 15.3:libpython2_7-1_0-2.7.18-150000.38.2 openSUSE Leap 15.3:libpython2_7-1_0-32bit-2.7.18-150000.38.2 openSUSE Leap 15.3:python-2.7.18-150000.38.1 openSUSE Leap 15.3:python-32bit-2.7.18-150000.38.1 openSUSE Leap 15.3:python-base-2.7.18-150000.38.2 openSUSE Leap 15.3:python-base-32bit-2.7.18-150000.38.2 openSUSE Leap 15.3:python-curses-2.7.18-150000.38.1 openSUSE Leap 15.3:python-demo-2.7.18-150000.38.1 openSUSE Leap 15.3:python-devel-2.7.18-150000.38.2 openSUSE Leap 15.3:python-doc-2.7.18-150000.38.1 openSUSE Leap 15.3:python-doc-pdf-2.7.18-150000.38.1 openSUSE Leap 15.3:python-gdbm-2.7.18-150000.38.1 openSUSE Leap 15.3:python-idle-2.7.18-150000.38.1 openSUSE Leap 15.3:python-tk-2.7.18-150000.38.1 openSUSE Leap 15.3:python-xml-2.7.18-150000.38.2 moderate 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ULIK4RFHGHTVVWROQ6NTBBB4JWOGWYD6/ https://www.suse.com/security/cve/CVE-2021-4189.html CVE-2021-4189 https://bugzilla.suse.com/1194146 SUSE Bug 1194146 A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14. CVE-2022-0391 openSUSE Leap 15.3:libpython2_7-1_0-2.7.18-150000.38.2 openSUSE Leap 15.3:libpython2_7-1_0-32bit-2.7.18-150000.38.2 openSUSE Leap 15.3:python-2.7.18-150000.38.1 openSUSE Leap 15.3:python-32bit-2.7.18-150000.38.1 openSUSE Leap 15.3:python-base-2.7.18-150000.38.2 openSUSE Leap 15.3:python-base-32bit-2.7.18-150000.38.2 openSUSE Leap 15.3:python-curses-2.7.18-150000.38.1 openSUSE Leap 15.3:python-demo-2.7.18-150000.38.1 openSUSE Leap 15.3:python-devel-2.7.18-150000.38.2 openSUSE Leap 15.3:python-doc-2.7.18-150000.38.1 openSUSE Leap 15.3:python-doc-pdf-2.7.18-150000.38.1 openSUSE Leap 15.3:python-gdbm-2.7.18-150000.38.1 openSUSE Leap 15.3:python-idle-2.7.18-150000.38.1 openSUSE Leap 15.3:python-tk-2.7.18-150000.38.1 openSUSE Leap 15.3:python-xml-2.7.18-150000.38.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ULIK4RFHGHTVVWROQ6NTBBB4JWOGWYD6/ https://www.suse.com/security/cve/CVE-2022-0391.html CVE-2022-0391 https://bugzilla.suse.com/1195396 SUSE Bug 1195396