Security update for python-defusedxml, python-freezegun, python-pkgconfig, python-python3-saml, python-xmlsec SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:0048-1 Final 1 1 2021-01-08T12:37:58Z current 2021-01-08T12:37:58Z 2021-01-08T12:37:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-defusedxml, python-freezegun, python-pkgconfig, python-python3-saml, python-xmlsec This update for python-defusedxml, python-freezegun, python-pkgconfig, python-python3-saml, python-xmlsec fixes the following issues: - Update to 0.6.0 - Increase test coverage. - Add badges to README. - Test on Python 3.7 stable and 3.8-dev - Drop support for Python 3.4 - No longer pass *html* argument to XMLParse. It has been deprecated and ignored for a long time. The DefusedXMLParser still takes a html argument. A deprecation warning is issued when the argument is False and a TypeError when it's True. - defusedxml now fails early when pyexpat stdlib module is not available or broken. - defusedxml.ElementTree.__all__ now lists ParseError as public attribute. - The defusedxml.ElementTree and defusedxml.cElementTree modules had a typo and used XMLParse instead of XMLParser as an alias for DefusedXMLParser. Both the old and fixed name are now available. - Remove superfluous devel dependency for noarch package - Update to 5.0 * Add compatibility with Python 3.6 * Drop support for Python 2.6, 3.1, 3.2, 3.3 * Fix lxml tests (XMLSyntaxError: Detected an entity reference loop) - Implement single-spec version. - Dummy changelog for bsc#1019074, FATE#322329 - Add dependency on the full python (which is not pulled by setuptools anymore). Use %{pythons} macro now. (bsc#1177200) - Upgrade to 0.3.12: * Refactor classes to functions * Ignore Selenium * Move to pytest * Conditionally patch time.clock (removed in 3.8) * Patch time.time_ns added in Python 3.7 - Do not require python2 module for building python3 module - Update to 0.3.11: * Performance improvements * Fix nesting time.time * Add nanosecond property - Remove superfluous devel dependency for noarch package - Add remove_dependency_on_mock.patch which removes dependency on python-mock for Python 3, where it is not required. - update to 0.3.10 * Performance improvements * Coroutine support - update to version 0.3.9 * If no time to be frozen, use current time * Fix uuid1 issues * Add support for python 3.6 update to version 0.3.8 * Improved unpatching when importing modules after freeze_time start() * Add manual increment via tick method * Fix bug with time.localtime not being reset. Closes #112. * Fix test to work when current timezone is GMT-14 or GMT+14. * Fixed #162 - allow decorating old-style classes. * Add support to PyMySQL * Assume the default time to freeze is 'now'. * Register fake types in PyMySQL conversions * Ignore threading and Queue modules. Closes #129. * Lock down coverage version since new coverage doesnt support py3.2 * Fix or py3 astimezone and not passing tz. Closes #138. * Add note about deafult arguments. Closes #140. * Add license info. Closes #120. - Update to 0.3.5 * No upstream changelog - Remove unneeded freeze_hideDeps.patch - Use download Url as source - Use tarball provided by pypi - update to 1.5.1 * Use poetry instead of setuptools directly * Fix #42: raise exception if package is missing * Fix version parsing for openssl-like version numbers, fixes #32 * Add boolean static keyword to output private libraries as well * Raise original OSError as well - Add missing test dependency pkgconfig The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-48,SUSE-Storage-6-2021-48 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20210048-1/ Link for SUSE-SU-2021:0048-1 https://lists.suse.com/pipermail/sle-security-updates/2021-January/008165.html E-Mail link for SUSE-SU-2021:0048-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1019074 SUSE Bug 1019074 https://bugzilla.suse.com/1041090 SUSE Bug 1041090 https://bugzilla.suse.com/1177200 SUSE Bug 1177200 https://www.suse.com/security/cve/CVE-2017-11427/ SUSE CVE CVE-2017-11427 page SUSE Enterprise Storage 6 python2-defusedxml-0.6.0-1.5.1 python2-freezegun-0.3.12-1.5.1 python2-isodate-0.6.0-1.3.2 python2-pkgconfig-1.5.1-1.5.1 python2-python3-saml-1.9.0-1.5.2 python2-xmlsec-1.3.6-1.5.1 python3-defusedxml-0.6.0-1.5.1 python3-freezegun-0.3.12-1.5.1 python3-isodate-0.6.0-1.3.2 python3-pkgconfig-1.5.1-1.5.1 python3-python3-saml-1.9.0-1.5.2 python3-xmlsec-1.3.6-1.5.1 python3-defusedxml-0.6.0-1.5.1 as a component of SUSE Enterprise Storage 6 python3-freezegun-0.3.12-1.5.1 as a component of SUSE Enterprise Storage 6 python3-isodate-0.6.0-1.3.2 as a component of SUSE Enterprise Storage 6 python3-pkgconfig-1.5.1-1.5.1 as a component of SUSE Enterprise Storage 6 python3-python3-saml-1.9.0-1.5.2 as a component of SUSE Enterprise Storage 6 python3-xmlsec-1.3.6-1.5.1 as a component of SUSE Enterprise Storage 6 OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers. CVE-2017-11427 SUSE Enterprise Storage 6:python3-defusedxml-0.6.0-1.5.1 SUSE Enterprise Storage 6:python3-freezegun-0.3.12-1.5.1 SUSE Enterprise Storage 6:python3-isodate-0.6.0-1.3.2 SUSE Enterprise Storage 6:python3-pkgconfig-1.5.1-1.5.1 SUSE Enterprise Storage 6:python3-python3-saml-1.9.0-1.5.2 SUSE Enterprise Storage 6:python3-xmlsec-1.3.6-1.5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210048-1/ https://www.suse.com/security/cve/CVE-2017-11427.html CVE-2017-11427 https://bugzilla.suse.com/1180767 SUSE Bug 1180767