Security update for python SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3002-1 Final 1 1 2018-10-04T12:17:50Z current 2018-10-04T12:17:50Z 2018-10-04T12:17:50Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python This update for python fixes the following issue: - CVE-2018-1000802: Prevent command injection in shutil module (make_archive function) via passage of unfiltered user input (bsc#1109663) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Basesystem-15-2018-2136,SUSE-SLE-Module-Desktop-Applications-15-2018-2136 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183002-1/ Link for SUSE-SU-2018:3002-1 https://lists.suse.com/pipermail/sle-security-updates/2018-October/004640.html E-Mail link for SUSE-SU-2018:3002-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1109663 SUSE Bug 1109663 https://www.suse.com/security/cve/CVE-2018-1000802/ SUSE CVE CVE-2018-1000802 page SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Desktop Applications 15 libpython2_7-1_0-2.7.14-7.3.1 python-2.7.14-7.3.1 python-base-2.7.14-7.3.1 python-curses-2.7.14-7.3.1 python-devel-2.7.14-7.3.1 python-gdbm-2.7.14-7.3.1 python-xml-2.7.14-7.3.1 python-tk-2.7.14-7.3.1 libpython2_7-1_0-2.7.14-7.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 python-2.7.14-7.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 python-base-2.7.14-7.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 python-curses-2.7.14-7.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 python-devel-2.7.14-7.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 python-gdbm-2.7.14-7.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 python-xml-2.7.14-7.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 python-tk-2.7.14-7.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace. CVE-2018-1000802 SUSE Linux Enterprise Module for Basesystem 15:libpython2_7-1_0-2.7.14-7.3.1 SUSE Linux Enterprise Module for Basesystem 15:python-2.7.14-7.3.1 SUSE Linux Enterprise Module for Basesystem 15:python-base-2.7.14-7.3.1 SUSE Linux Enterprise Module for Basesystem 15:python-curses-2.7.14-7.3.1 SUSE Linux Enterprise Module for Basesystem 15:python-devel-2.7.14-7.3.1 SUSE Linux Enterprise Module for Basesystem 15:python-gdbm-2.7.14-7.3.1 SUSE Linux Enterprise Module for Basesystem 15:python-xml-2.7.14-7.3.1 SUSE Linux Enterprise Module for Desktop Applications 15:python-tk-2.7.14-7.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183002-1/ https://www.suse.com/security/cve/CVE-2018-1000802.html CVE-2018-1000802 https://bugzilla.suse.com/1109663 SUSE Bug 1109663