Security update for python SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1344-1 Final 1 1 2015-06-30T13:56:32Z current 2015-06-30T13:56:32Z 2015-06-30T13:56:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python This update to python 2.7.9 fixes the following issues: * python-2.7-libffi-aarch64.patch: Fix argument passing in libffi for aarch64 From the version update to 2.7.9: * contains full backport of ssl module from Python 3.4 (PEP466) * HTTPS certificate validation enabled by default (PEP476) * SSLv3 disabled by default (bnc#901715) * backported ensurepip module (PEP477) * fixes several missing CVEs from last release: CVE-2013-1752, CVE-2013-1753 * dropped upstreamed patches: python-2.7.6-poplib.patch, smtplib_maxline-2.7.patch, xmlrpc_gzip_27.patch * dropped patch python-2.7.3-ssl_ca_path.patch because we don't need it with ssl module from Python 3 * libffi was upgraded upstream, seems to contain our changes, so dropping libffi-ppc64le.diff as well * python-2.7-urllib2-localnet-ssl.patch - properly remove unconditional 'import ssl' from test_urllib2_localnet that caused it to fail without ssl * skip test_thread in qemu_linux_user mode From the version update to 2.7.8: * fixes CVE-2014-4650 directory traversal in CGIHTTPServer * fixes CVE-2014-7185 (bnc#898572) potential buffer overflow in buffer() Also the DH parameters were increased to 2048 bit to fix logjam security issue (bsc#935856) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-367,SUSE-SLE-SDK-12-2015-367,SUSE-SLE-SERVER-12-2015-367,SUSE-SLE-WE-12-2015-367 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151344-1/ Link for SUSE-SU-2015:1344-1 https://lists.suse.com/pipermail/sle-security-updates/2015-August/001525.html E-Mail link for SUSE-SU-2015:1344-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/898572 SUSE Bug 898572 https://bugzilla.suse.com/901715 SUSE Bug 901715 https://bugzilla.suse.com/924312 SUSE Bug 924312 https://bugzilla.suse.com/935856 SUSE Bug 935856 https://www.suse.com/security/cve/CVE-2013-1752/ SUSE CVE CVE-2013-1752 page https://www.suse.com/security/cve/CVE-2013-1753/ SUSE CVE CVE-2013-1753 page https://www.suse.com/security/cve/CVE-2014-4650/ SUSE CVE CVE-2014-4650 page https://www.suse.com/security/cve/CVE-2014-7185/ SUSE CVE CVE-2014-7185 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Workstation Extension 12 libpython2_7-1_0-2.7.9-14.1 libpython2_7-1_0-32bit-2.7.9-14.1 python-2.7.9-14.1 python-base-2.7.9-14.1 python-curses-2.7.9-14.1 python-devel-2.7.9-14.1 python-tk-2.7.9-14.1 python-xml-2.7.9-14.1 python-32bit-2.7.9-14.1 python-base-32bit-2.7.9-14.1 python-demo-2.7.9-14.1 python-doc-2.7.9-14.3 python-doc-pdf-2.7.9-14.3 python-gdbm-2.7.9-14.1 python-idle-2.7.9-14.1 libpython2_7-1_0-2.7.9-14.1 as a component of SUSE Linux Enterprise Desktop 12 libpython2_7-1_0-32bit-2.7.9-14.1 as a component of SUSE Linux Enterprise Desktop 12 python-2.7.9-14.1 as a component of SUSE Linux Enterprise Desktop 12 python-base-2.7.9-14.1 as a component of SUSE Linux Enterprise Desktop 12 python-curses-2.7.9-14.1 as a component of SUSE Linux Enterprise Desktop 12 python-devel-2.7.9-14.1 as a component of SUSE Linux Enterprise Desktop 12 python-tk-2.7.9-14.1 as a component of SUSE Linux Enterprise Desktop 12 python-xml-2.7.9-14.1 as a component of SUSE Linux Enterprise Desktop 12 libpython2_7-1_0-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 libpython2_7-1_0-32bit-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-32bit-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-base-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-base-32bit-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-curses-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-demo-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-doc-2.7.9-14.3 as a component of SUSE Linux Enterprise Server 12 python-doc-pdf-2.7.9-14.3 as a component of SUSE Linux Enterprise Server 12 python-gdbm-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-idle-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-tk-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 python-xml-2.7.9-14.1 as a component of SUSE Linux Enterprise Server 12 libpython2_7-1_0-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libpython2_7-1_0-32bit-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-32bit-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-base-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-base-32bit-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-curses-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-demo-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-doc-2.7.9-14.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-doc-pdf-2.7.9-14.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-gdbm-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-idle-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-tk-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-xml-2.7.9-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 python-devel-2.7.9-14.1 as a component of SUSE Linux Enterprise Software Development Kit 12 python-devel-2.7.9-14.1 as a component of SUSE Linux Enterprise Workstation Extension 12 ** REJECT ** Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service (memory consumption) via a long string, related to (1) httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; (2) ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; (3) imaplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; (4) nntplib - fixed in 2.7.6, 2.6.9, 3.3.3; (5) poplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; and (6) smtplib - not yet fixed in 2.7.x, fixed in 2.6.9, not yet fixed in 3.3.x. NOTE: this was REJECTed because it is incompatible with CNT1 "Independently Fixable" in the CVE Counting Decisions. CVE-2013-1752 SUSE Linux Enterprise Desktop 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-devel-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Server 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Server 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-base-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-demo-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-doc-2.7.9-14.3 SUSE Linux Enterprise Server 12:python-doc-pdf-2.7.9-14.3 SUSE Linux Enterprise Server 12:python-gdbm-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-idle-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-base-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-demo-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-doc-2.7.9-14.3 SUSE Linux Enterprise Server for SAP Applications 12:python-doc-pdf-2.7.9-14.3 SUSE Linux Enterprise Server for SAP Applications 12:python-gdbm-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-idle-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Software Development Kit 12:python-devel-2.7.9-14.1 SUSE Linux Enterprise Workstation Extension 12:python-devel-2.7.9-14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151344-1/ https://www.suse.com/security/cve/CVE-2013-1752.html CVE-2013-1752 https://bugzilla.suse.com/856835 SUSE Bug 856835 https://bugzilla.suse.com/856836 SUSE Bug 856836 https://bugzilla.suse.com/863741 SUSE Bug 863741 https://bugzilla.suse.com/885882 SUSE Bug 885882 https://bugzilla.suse.com/898572 SUSE Bug 898572 https://bugzilla.suse.com/912739 SUSE Bug 912739 The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request. CVE-2013-1753 SUSE Linux Enterprise Desktop 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-devel-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Server 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Server 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-base-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-demo-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-doc-2.7.9-14.3 SUSE Linux Enterprise Server 12:python-doc-pdf-2.7.9-14.3 SUSE Linux Enterprise Server 12:python-gdbm-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-idle-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-base-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-demo-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-doc-2.7.9-14.3 SUSE Linux Enterprise Server for SAP Applications 12:python-doc-pdf-2.7.9-14.3 SUSE Linux Enterprise Server for SAP Applications 12:python-gdbm-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-idle-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Software Development Kit 12:python-devel-2.7.9-14.1 SUSE Linux Enterprise Workstation Extension 12:python-devel-2.7.9-14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151344-1/ https://www.suse.com/security/cve/CVE-2013-1753.html CVE-2013-1753 https://bugzilla.suse.com/856835 SUSE Bug 856835 The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator. CVE-2014-4650 SUSE Linux Enterprise Desktop 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-devel-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Server 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Server 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-base-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-demo-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-doc-2.7.9-14.3 SUSE Linux Enterprise Server 12:python-doc-pdf-2.7.9-14.3 SUSE Linux Enterprise Server 12:python-gdbm-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-idle-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-base-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-demo-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-doc-2.7.9-14.3 SUSE Linux Enterprise Server for SAP Applications 12:python-doc-pdf-2.7.9-14.3 SUSE Linux Enterprise Server for SAP Applications 12:python-gdbm-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-idle-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Software Development Kit 12:python-devel-2.7.9-14.1 SUSE Linux Enterprise Workstation Extension 12:python-devel-2.7.9-14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151344-1/ https://www.suse.com/security/cve/CVE-2014-4650.html CVE-2014-4650 https://bugzilla.suse.com/856835 SUSE Bug 856835 https://bugzilla.suse.com/856836 SUSE Bug 856836 https://bugzilla.suse.com/863741 SUSE Bug 863741 https://bugzilla.suse.com/885882 SUSE Bug 885882 https://bugzilla.suse.com/898572 SUSE Bug 898572 https://bugzilla.suse.com/912739 SUSE Bug 912739 Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function. CVE-2014-7185 SUSE Linux Enterprise Desktop 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-devel-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Desktop 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Server 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Server 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-base-32bit-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-demo-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-doc-2.7.9-14.3 SUSE Linux Enterprise Server 12:python-doc-pdf-2.7.9-14.3 SUSE Linux Enterprise Server 12:python-gdbm-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-idle-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Server 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libpython2_7-1_0-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libpython2_7-1_0-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-base-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-base-32bit-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-curses-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-demo-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-doc-2.7.9-14.3 SUSE Linux Enterprise Server for SAP Applications 12:python-doc-pdf-2.7.9-14.3 SUSE Linux Enterprise Server for SAP Applications 12:python-gdbm-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-idle-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-tk-2.7.9-14.1 SUSE Linux Enterprise Server for SAP Applications 12:python-xml-2.7.9-14.1 SUSE Linux Enterprise Software Development Kit 12:python-devel-2.7.9-14.1 SUSE Linux Enterprise Workstation Extension 12:python-devel-2.7.9-14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151344-1/ https://www.suse.com/security/cve/CVE-2014-7185.html CVE-2014-7185 https://bugzilla.suse.com/898572 SUSE Bug 898572 https://bugzilla.suse.com/912739 SUSE Bug 912739 https://bugzilla.suse.com/913479 SUSE Bug 913479 https://bugzilla.suse.com/955182 SUSE Bug 955182