Security update for python36 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0557-1 Final 1 1 2020-03-02T13:23:53Z current 2020-03-02T13:23:53Z 2020-03-02T13:23:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python36 This update for python36 fixes the following issues: Security issues fixed: - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825). - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP (bsc#1162367). Non-security issue fixed: - If the locale is 'C', coerce it to C.UTF-8 (bsc#1162423). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-BYOS-2020-557,Image SLES12-SP5-Azure-Basic-On-Demand-2020-557,Image SLES12-SP5-Azure-HPC-BYOS-2020-557,Image SLES12-SP5-Azure-HPC-On-Demand-2020-557,Image SLES12-SP5-Azure-SAP-BYOS-2020-557,Image SLES12-SP5-Azure-SAP-On-Demand-2020-557,Image SLES12-SP5-Azure-Standard-On-Demand-2020-557,Image SLES12-SP5-EC2-BYOS-2020-557,Image SLES12-SP5-EC2-ECS-On-Demand-2020-557,Image SLES12-SP5-EC2-On-Demand-2020-557,Image SLES12-SP5-EC2-SAP-BYOS-2020-557,Image SLES12-SP5-EC2-SAP-On-Demand-2020-557,Image SLES12-SP5-GCE-BYOS-2020-557,Image SLES12-SP5-GCE-On-Demand-2020-557,Image SLES12-SP5-GCE-SAP-BYOS-2020-557,Image SLES12-SP5-GCE-SAP-On-Demand-2020-557,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2020-557,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2020-557,SUSE-2020-557,SUSE-SLE-SERVER-12-SP5-2020-557 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200557-1/ Link for SUSE-SU-2020:0557-1 https://lists.suse.com/pipermail/sle-security-updates/2020-March/006563.html E-Mail link for SUSE-SU-2020:0557-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1162367 SUSE Bug 1162367 https://bugzilla.suse.com/1162423 SUSE Bug 1162423 https://bugzilla.suse.com/1162825 SUSE Bug 1162825 https://www.suse.com/security/cve/CVE-2019-9674/ SUSE CVE CVE-2019-9674 page https://www.suse.com/security/cve/CVE-2020-8492/ SUSE CVE CVE-2020-8492 page Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpython3_6m1_0-3.6.10-4.6.1 python36-base-3.6.10-4.6.1 libpython3_6m1_0-32bit-3.6.10-4.6.1 libpython3_6m1_0-64bit-3.6.10-4.6.1 python36-3.6.10-4.6.1 python36-32bit-3.6.10-4.6.1 python36-64bit-3.6.10-4.6.1 python36-base-32bit-3.6.10-4.6.1 python36-base-64bit-3.6.10-4.6.1 python36-curses-3.6.10-4.6.1 python36-dbm-3.6.10-4.6.1 python36-devel-3.6.10-4.6.1 python36-doc-3.6.10-4.6.1 python36-idle-3.6.10-4.6.1 python36-testsuite-3.6.10-4.6.1 python36-tk-3.6.10-4.6.1 python36-tools-3.6.10-4.6.1 libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-BYOS python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-BYOS libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-BYOS python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-BYOS libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-On-Demand python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-On-Demand libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-GCE-BYOS python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-GCE-BYOS libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-GCE-On-Demand python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-GCE-On-Demand libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libpython3_6m1_0-3.6.10-4.6.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production python36-base-3.6.10-4.6.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libpython3_6m1_0-3.6.10-4.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 python36-3.6.10-4.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 python36-base-3.6.10-4.6.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpython3_6m1_0-3.6.10-4.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python36-3.6.10-4.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python36-base-3.6.10-4.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. CVE-2019-9674 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-Basic-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-Basic-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.10-4.6.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.10-4.6.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.10-4.6.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.10-4.6.1 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.10-4.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.10-4.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.10-4.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.10-4.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200557-1/ https://www.suse.com/security/cve/CVE-2019-9674.html CVE-2019-9674 https://bugzilla.suse.com/1162825 SUSE Bug 1162825 Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. CVE-2020-8492 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-Basic-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-Basic-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.10-4.6.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.10-4.6.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.10-4.6.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.10-4.6.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.10-4.6.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.10-4.6.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.10-4.6.1 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.10-4.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.10-4.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.10-4.6.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.10-4.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200557-1/ https://www.suse.com/security/cve/CVE-2020-8492.html CVE-2020-8492 https://bugzilla.suse.com/1162367 SUSE Bug 1162367