Security update for python36 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3865-1 Final 1 1 2020-12-17T11:05:36Z current 2020-12-17T11:05:36Z 2020-12-17T11:05:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python36 This update for python36 fixes the following issues: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen() (bsc#1155094) - CVE-2019-20916: Fixed a directory traversal in _download_http_url() (bsc#1176262). - CVE-2020-27619: Fixed an issue where the CJK codec tests call eval() on content retrieved via HTTP (bsc#1178009). - CVE-2020-8492: Fixed a regular expression in urrlib that was prone to denial of service via HTTP (bsc#1162367). - Working-around missing python-packaging dependency in python-Sphinx is not necessary anymore (bsc#1174571). - Build of python3 documentation is not independent on the version of Sphinx(bsc#1179630). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-BYOS-2020-3865,Image SLES12-SP5-Azure-Basic-On-Demand-2020-3865,Image SLES12-SP5-Azure-HPC-BYOS-2020-3865,Image SLES12-SP5-Azure-HPC-On-Demand-2020-3865,Image SLES12-SP5-Azure-SAP-BYOS-2020-3865,Image SLES12-SP5-Azure-SAP-On-Demand-2020-3865,Image SLES12-SP5-Azure-Standard-On-Demand-2020-3865,Image SLES12-SP5-EC2-BYOS-2020-3865,Image SLES12-SP5-EC2-ECS-On-Demand-2020-3865,Image SLES12-SP5-EC2-On-Demand-2020-3865,Image SLES12-SP5-EC2-SAP-BYOS-2020-3865,Image SLES12-SP5-EC2-SAP-On-Demand-2020-3865,Image SLES12-SP5-GCE-BYOS-2020-3865,Image SLES12-SP5-GCE-On-Demand-2020-3865,Image SLES12-SP5-GCE-SAP-BYOS-2020-3865,Image SLES12-SP5-GCE-SAP-On-Demand-2020-3865,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2020-3865,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2020-3865,SUSE-2020-3865,SUSE-SLE-SERVER-12-SP5-2020-3865 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203865-1/ Link for SUSE-SU-2020:3865-1 https://lists.suse.com/pipermail/sle-security-updates/2020-December/008081.html E-Mail link for SUSE-SU-2020:3865-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1155094 SUSE Bug 1155094 https://bugzilla.suse.com/1162367 SUSE Bug 1162367 https://bugzilla.suse.com/1174571 SUSE Bug 1174571 https://bugzilla.suse.com/1176262 SUSE Bug 1176262 https://bugzilla.suse.com/1178009 SUSE Bug 1178009 https://bugzilla.suse.com/1179630 SUSE Bug 1179630 https://www.suse.com/security/cve/CVE-2019-18348/ SUSE CVE CVE-2019-18348 page https://www.suse.com/security/cve/CVE-2019-20916/ SUSE CVE CVE-2019-20916 page https://www.suse.com/security/cve/CVE-2020-27619/ SUSE CVE CVE-2020-27619 page https://www.suse.com/security/cve/CVE-2020-8492/ SUSE CVE CVE-2020-8492 page Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 libpython3_6m1_0-3.6.12-4.25.1 python36-base-3.6.12-4.25.1 libpython3_6m1_0-32bit-3.6.12-4.25.1 libpython3_6m1_0-64bit-3.6.12-4.25.1 python36-3.6.12-4.25.1 python36-32bit-3.6.12-4.25.1 python36-64bit-3.6.12-4.25.1 python36-base-32bit-3.6.12-4.25.1 python36-base-64bit-3.6.12-4.25.1 python36-curses-3.6.12-4.25.1 python36-dbm-3.6.12-4.25.1 python36-devel-3.6.12-4.25.1 python36-doc-3.6.12-4.25.1 python36-doc-devhelp-3.6.12-4.25.1 python36-idle-3.6.12-4.25.1 python36-testsuite-3.6.12-4.25.1 python36-tk-3.6.12-4.25.1 python36-tools-3.6.12-4.25.1 libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-BYOS python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-BYOS libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-BYOS python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-BYOS libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-On-Demand python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-On-Demand libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-GCE-BYOS python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-GCE-BYOS libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-GCE-On-Demand python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-GCE-On-Demand libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libpython3_6m1_0-3.6.12-4.25.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production python36-base-3.6.12-4.25.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libpython3_6m1_0-3.6.12-4.25.1 as a component of SUSE Linux Enterprise Server 12 SP5 python36-3.6.12-4.25.1 as a component of SUSE Linux Enterprise Server 12 SP5 python36-base-3.6.12-4.25.1 as a component of SUSE Linux Enterprise Server 12 SP5 libpython3_6m1_0-3.6.12-4.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python36-3.6.12-4.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python36-base-3.6.12-4.25.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1. CVE-2019-18348 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-Basic-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-Basic-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.12-4.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203865-1/ https://www.suse.com/security/cve/CVE-2019-18348.html CVE-2019-18348 https://bugzilla.suse.com/1155094 SUSE Bug 1155094 The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. CVE-2019-20916 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-Basic-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-Basic-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.12-4.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203865-1/ https://www.suse.com/security/cve/CVE-2019-20916.html CVE-2019-20916 https://bugzilla.suse.com/1176262 SUSE Bug 1176262 In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. CVE-2020-27619 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-Basic-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-Basic-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.12-4.25.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203865-1/ https://www.suse.com/security/cve/CVE-2020-27619.html CVE-2020-27619 https://bugzilla.suse.com/1178009 SUSE Bug 1178009 https://bugzilla.suse.com/1180254 SUSE Bug 1180254 https://bugzilla.suse.com/1193386 SUSE Bug 1193386 Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. CVE-2020-8492 Image SLES12-SP5-Azure-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-Basic-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-Basic-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-HPC-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-Azure-Standard-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-ECS-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-EC2-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-BYOS:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-BYOS:python36-base-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-GCE-SAP-On-Demand:python36-base-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:python36-base-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpython3_6m1_0-3.6.12-4.25.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:python36-base-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:libpython3_6m1_0-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:python36-3.6.12-4.25.1 SUSE Linux Enterprise Server 12 SP5:python36-base-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libpython3_6m1_0-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-3.6.12-4.25.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-base-3.6.12-4.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203865-1/ https://www.suse.com/security/cve/CVE-2020-8492.html CVE-2020-8492 https://bugzilla.suse.com/1162367 SUSE Bug 1162367