Security update for python SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:3156-1 Final 1 1 2018-10-16T09:06:19Z current 2018-10-16T09:06:19Z 2018-10-16T09:06:19Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python This update for python fixes the following issue: - CVE-2018-14647: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM (bsc#1109847) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-python-13818,slessp4-python-13818 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20183156-1/ Link for SUSE-SU-2018:3156-1 https://lists.suse.com/pipermail/sle-security-updates/2018-October/004672.html E-Mail link for SUSE-SU-2018:3156-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1109847 SUSE Bug 1109847 https://www.suse.com/security/cve/CVE-2018-14647/ SUSE CVE CVE-2018-14647 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 python-32bit-2.6.9-40.21.2 python-demo-2.6.9-40.21.2 python-devel-2.6.9-40.21.1 python-doc-2.6-8.40.21.1 python-doc-pdf-2.6-8.40.21.1 python-gdbm-2.6.9-40.21.2 python-idle-2.6.9-40.21.2 python-tk-2.6.9-40.21.2 libpython2_6-1_0-2.6.9-40.21.1 libpython2_6-1_0-32bit-2.6.9-40.21.1 libpython2_6-1_0-x86-2.6.9-40.21.1 python-2.6.9-40.21.2 python-base-2.6.9-40.21.1 python-base-32bit-2.6.9-40.21.1 python-base-x86-2.6.9-40.21.1 python-curses-2.6.9-40.21.2 python-x86-2.6.9-40.21.2 python-xml-2.6.9-40.21.1 libpython2_6-1_0-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server 11 SP4 libpython2_6-1_0-32bit-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server 11 SP4 libpython2_6-1_0-x86-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server 11 SP4 python-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server 11 SP4 python-32bit-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server 11 SP4 python-base-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server 11 SP4 python-base-32bit-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server 11 SP4 python-base-x86-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server 11 SP4 python-curses-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server 11 SP4 python-demo-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server 11 SP4 python-doc-2.6-8.40.21.1 as a component of SUSE Linux Enterprise Server 11 SP4 python-doc-pdf-2.6-8.40.21.1 as a component of SUSE Linux Enterprise Server 11 SP4 python-gdbm-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server 11 SP4 python-idle-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server 11 SP4 python-tk-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server 11 SP4 python-x86-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server 11 SP4 python-xml-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server 11 SP4 libpython2_6-1_0-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libpython2_6-1_0-32bit-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libpython2_6-1_0-x86-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-32bit-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-base-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-base-32bit-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-base-x86-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-curses-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-demo-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-doc-2.6-8.40.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-doc-pdf-2.6-8.40.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-gdbm-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-idle-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-tk-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-x86-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-xml-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 python-32bit-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 python-demo-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 python-devel-2.6.9-40.21.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 python-doc-2.6-8.40.21.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 python-doc-pdf-2.6-8.40.21.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 python-gdbm-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 python-idle-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 python-tk-2.6.9-40.21.2 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15. CVE-2018-14647 SUSE Linux Enterprise Server 11 SP4:libpython2_6-1_0-2.6.9-40.21.1 SUSE Linux Enterprise Server 11 SP4:libpython2_6-1_0-32bit-2.6.9-40.21.1 SUSE Linux Enterprise Server 11 SP4:libpython2_6-1_0-x86-2.6.9-40.21.1 SUSE Linux Enterprise Server 11 SP4:python-2.6.9-40.21.2 SUSE Linux Enterprise Server 11 SP4:python-32bit-2.6.9-40.21.2 SUSE Linux Enterprise Server 11 SP4:python-base-2.6.9-40.21.1 SUSE Linux Enterprise Server 11 SP4:python-base-32bit-2.6.9-40.21.1 SUSE Linux Enterprise Server 11 SP4:python-base-x86-2.6.9-40.21.1 SUSE Linux Enterprise Server 11 SP4:python-curses-2.6.9-40.21.2 SUSE Linux Enterprise Server 11 SP4:python-demo-2.6.9-40.21.2 SUSE Linux Enterprise Server 11 SP4:python-doc-2.6-8.40.21.1 SUSE Linux Enterprise Server 11 SP4:python-doc-pdf-2.6-8.40.21.1 SUSE Linux Enterprise Server 11 SP4:python-gdbm-2.6.9-40.21.2 SUSE Linux Enterprise Server 11 SP4:python-idle-2.6.9-40.21.2 SUSE Linux Enterprise Server 11 SP4:python-tk-2.6.9-40.21.2 SUSE Linux Enterprise Server 11 SP4:python-x86-2.6.9-40.21.2 SUSE Linux Enterprise Server 11 SP4:python-xml-2.6.9-40.21.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpython2_6-1_0-2.6.9-40.21.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpython2_6-1_0-32bit-2.6.9-40.21.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpython2_6-1_0-x86-2.6.9-40.21.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-2.6.9-40.21.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-32bit-2.6.9-40.21.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-base-2.6.9-40.21.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-base-32bit-2.6.9-40.21.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-base-x86-2.6.9-40.21.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-curses-2.6.9-40.21.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-demo-2.6.9-40.21.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-doc-2.6-8.40.21.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-doc-pdf-2.6-8.40.21.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-gdbm-2.6.9-40.21.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-idle-2.6.9-40.21.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-tk-2.6.9-40.21.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-x86-2.6.9-40.21.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:python-xml-2.6.9-40.21.1 SUSE Linux Enterprise Software Development Kit 11 SP4:python-32bit-2.6.9-40.21.2 SUSE Linux Enterprise Software Development Kit 11 SP4:python-demo-2.6.9-40.21.2 SUSE Linux Enterprise Software Development Kit 11 SP4:python-devel-2.6.9-40.21.1 SUSE Linux Enterprise Software Development Kit 11 SP4:python-doc-2.6-8.40.21.1 SUSE Linux Enterprise Software Development Kit 11 SP4:python-doc-pdf-2.6-8.40.21.1 SUSE Linux Enterprise Software Development Kit 11 SP4:python-gdbm-2.6.9-40.21.2 SUSE Linux Enterprise Software Development Kit 11 SP4:python-idle-2.6.9-40.21.2 SUSE Linux Enterprise Software Development Kit 11 SP4:python-tk-2.6.9-40.21.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20183156-1/ https://www.suse.com/security/cve/CVE-2018-14647.html CVE-2018-14647 https://bugzilla.suse.com/1109847 SUSE Bug 1109847 https://bugzilla.suse.com/1126909 SUSE Bug 1126909