Security update for python39 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2940-1 Final 1 1 2021-09-03T07:22:28Z current 2021-09-03T07:22:28Z 2021-09-03T07:22:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python39 This update for python39 fixes the following issues: - CVE-2021-29921: Fixed improper input validation of octal string IP addresses (bsc#1185706). - Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858). - Stop providing 'python' symbol (bsc#1185588), which means python2 currently. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/python:3-2021-2940,SUSE-2021-2940,SUSE-SLE-Module-Basesystem-15-SP3-2021-2940,SUSE-SLE-Module-Development-Tools-15-SP3-2021-2940 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212940-1/ Link for SUSE-SU-2021:2940-1 https://lists.suse.com/pipermail/sle-security-updates/2021-September/009402.html E-Mail link for SUSE-SU-2021:2940-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1183858 SUSE Bug 1183858 https://bugzilla.suse.com/1185588 SUSE Bug 1185588 https://bugzilla.suse.com/1185706 SUSE Bug 1185706 https://www.suse.com/security/cve/CVE-2021-29921/ SUSE CVE CVE-2021-29921 page Container bci/python:3 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP3 libpython3_9-1_0-3.9.6-4.3.3 python39-3.9.6-4.3.4 python39-base-3.9.6-4.3.3 python39-devel-3.9.6-4.3.3 libpython3_9-1_0-32bit-3.9.6-4.3.3 libpython3_9-1_0-64bit-3.9.6-4.3.3 python39-32bit-3.9.6-4.3.4 python39-64bit-3.9.6-4.3.4 python39-base-32bit-3.9.6-4.3.3 python39-base-64bit-3.9.6-4.3.3 python39-curses-3.9.6-4.3.4 python39-dbm-3.9.6-4.3.4 python39-doc-3.9.6-4.3.1 python39-doc-devhelp-3.9.6-4.3.1 python39-idle-3.9.6-4.3.4 python39-testsuite-3.9.6-4.3.3 python39-tk-3.9.6-4.3.4 python39-tools-3.9.6-4.3.3 libpython3_9-1_0-3.9.6-4.3.3 as a component of Container bci/python:3 python39-3.9.6-4.3.4 as a component of Container bci/python:3 python39-base-3.9.6-4.3.3 as a component of Container bci/python:3 python39-devel-3.9.6-4.3.3 as a component of Container bci/python:3 libpython3_9-1_0-3.9.6-4.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python39-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python39-base-3.9.6-4.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python39-curses-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python39-dbm-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python39-devel-3.9.6-4.3.3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python39-idle-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python39-tk-3.9.6-4.3.4 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python39-tools-3.9.6-4.3.3 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses. CVE-2021-29921 Container bci/python:3:libpython3_9-1_0-3.9.6-4.3.3 Container bci/python:3:python39-3.9.6-4.3.4 Container bci/python:3:python39-base-3.9.6-4.3.3 Container bci/python:3:python39-devel-3.9.6-4.3.3 SUSE Linux Enterprise Module for Basesystem 15 SP3:libpython3_9-1_0-3.9.6-4.3.3 SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-3.9.6-4.3.4 SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-base-3.9.6-4.3.3 SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-curses-3.9.6-4.3.4 SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-dbm-3.9.6-4.3.4 SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-devel-3.9.6-4.3.3 SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-idle-3.9.6-4.3.4 SUSE Linux Enterprise Module for Basesystem 15 SP3:python39-tk-3.9.6-4.3.4 SUSE Linux Enterprise Module for Development Tools 15 SP3:python39-tools-3.9.6-4.3.3 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212940-1/ https://www.suse.com/security/cve/CVE-2021-29921.html CVE-2021-29921 https://bugzilla.suse.com/1185706 SUSE Bug 1185706