Security update for python36 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:0428-1 Final 1 1 2021-02-10T15:46:12Z current 2021-02-10T15:46:12Z 2021-02-10T15:46:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python36 This update for python36 fixes the following issues: - buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution (bsc#1181126, CVE-2021-3177). - Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-BYOS-2021-428,Image SLES12-SP5-Azure-Basic-On-Demand-2021-428,Image SLES12-SP5-Azure-HPC-BYOS-2021-428,Image SLES12-SP5-Azure-HPC-On-Demand-2021-428,Image SLES12-SP5-Azure-SAP-BYOS-2021-428,Image SLES12-SP5-Azure-SAP-On-Demand-2021-428,Image SLES12-SP5-Azure-Standard-On-Demand-2021-428,Image SLES12-SP5-EC2-BYOS-2021-428,Image SLES12-SP5-EC2-ECS-On-Demand-2021-428,Image SLES12-SP5-EC2-On-Demand-2021-428,Image SLES12-SP5-EC2-SAP-BYOS-2021-428,Image SLES12-SP5-EC2-SAP-On-Demand-2021-428,Image SLES12-SP5-GCE-BYOS-2021-428,Image SLES12-SP5-GCE-On-Demand-2021-428,Image SLES12-SP5-GCE-SAP-BYOS-2021-428,Image SLES12-SP5-GCE-SAP-On-Demand-2021-428,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2021-428,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2021-428,SUSE-2021-428,SUSE-SLE-SERVER-12-SP5-2021-428 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20210428-1/ Link for SUSE-SU-2021:0428-1 https://lists.suse.com/pipermail/sle-security-updates/2021-February/008303.html E-Mail link for SUSE-SU-2021:0428-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1176262 SUSE Bug 1176262 https://bugzilla.suse.com/1180686 SUSE Bug 1180686 https://bugzilla.suse.com/1181126 SUSE Bug 1181126 https://www.suse.com/security/cve/CVE-2019-20916/ SUSE CVE CVE-2019-20916 page https://www.suse.com/security/cve/CVE-2021-3177/ SUSE CVE CVE-2021-3177 page Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpython3_6m1_0-3.6.12-4.33.1 python36-base-3.6.12-4.33.1 libpython3_6m1_0-32bit-3.6.12-4.33.1 libpython3_6m1_0-64bit-3.6.12-4.33.1 python36-3.6.12-4.33.3 python36-32bit-3.6.12-4.33.3 python36-64bit-3.6.12-4.33.3 python36-base-32bit-3.6.12-4.33.1 python36-base-64bit-3.6.12-4.33.1 python36-curses-3.6.12-4.33.3 python36-dbm-3.6.12-4.33.3 python36-devel-3.6.12-4.33.1 python36-doc-3.6.12-4.33.4 python36-doc-devhelp-3.6.12-4.33.4 python36-idle-3.6.12-4.33.3 python36-testsuite-3.6.12-4.33.1 python36-tk-3.6.12-4.33.3 python36-tools-3.6.12-4.33.1 libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-BYOS python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-BYOS libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-BYOS python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-BYOS libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-On-Demand python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-On-Demand libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-GCE-BYOS python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-GCE-BYOS libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-GCE-On-Demand python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-GCE-On-Demand libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libpython3_6m1_0-3.6.12-4.33.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production python36-base-3.6.12-4.33.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libpython3_6m1_0-3.6.12-4.33.1 as a component of SUSE Linux Enterprise Server 12 SP5 python36-3.6.12-4.33.3 as a component of SUSE Linux Enterprise Server 12 SP5 python36-base-3.6.12-4.33.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpython3_6m1_0-3.6.12-4.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python36-3.6.12-4.33.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python36-base-3.6.12-4.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. CVE-2019-20916 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-Basic-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-Basic-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.12-4.33.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.12-4.33.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.12-4.33.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.12-4.33.3 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.12-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.12-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.12-4.33.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.12-4.33.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210428-1/ https://www.suse.com/security/cve/CVE-2019-20916.html CVE-2019-20916 https://bugzilla.suse.com/1176262 SUSE Bug 1176262 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. CVE-2021-3177 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-Basic-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-Basic-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.12-4.33.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.12-4.33.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.12-4.33.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.12-4.33.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.12-4.33.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.12-4.33.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.12-4.33.3 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.12-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.12-4.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.12-4.33.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.12-4.33.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210428-1/ https://www.suse.com/security/cve/CVE-2021-3177.html CVE-2021-3177 https://bugzilla.suse.com/1181126 SUSE Bug 1181126